13335 is consistent with the provisions of such sec-
tion 3001. 
(2) AHIC.—Nothing in sections 3002 or 3003 
of the Public Health Service Act, as added by sec-
tion 101, or subsection (b) shall be construed as re-
quiring the creation of a new entity to the extent 
that the American Health Information Community 
created in response to Executive Order 13335 is 
consistent with the provisions of such sections 3002 
and 3003. 
PART II—APPLICATION AND USE OF ADOPTED 
HEALTH 
INFORMATION 
TECHNOLOGY 
STANDARDS; REPORTS 
SEC. 111. COORDINATION OF FEDERAL ACTIVITIES WITH 
ADOPTED STANDARDS AND IMPLEMENTA-
TION SPECIFICATIONS. 
(a) SPENDING
ON HEALTH INFORMATION TECH-
NOLOGY SYSTEMS.—As each agency (as defined in the Ex-
ecutive Order issued on August 22, 2006, relating to pro-
moting quality and efficient health care in Federal govern-
ment administered or sponsored health care programs) im-
plements, acquires, or upgrades health information tech-
nology systems used for the direct exchange of individually 
identifiable health information between agencies and with 
non-Federal entities, it shall utilize, where available, 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
health information technology systems and products that 
meet standards and implementation specifications adopted 
under section 3004(b) of the Public Health Service Act, 
as added by section 101. 
(b) FEDERAL INFORMATION COLLECTION ACTIVI-
TIES.—With respect to a standard or implementation 
specification adopted under section 3004(b) of the Public 
Health Service Act, as added by section 101, the President 
shall take measures to ensure that Federal activities in-
volving the broad collection and submission of health in-
formation are consistent with such standard or specifica-
tion, respectively, within three years after the date of such 
adoption. 
(c) APPLICATION OF DEFINITIONS.—The definitions 
contained in section 3000 of the Public Health Service 
Act, as added by section 101, shall apply for purposes of 
this part. 
SEC. 112. APPLICATION TO PRIVATE ENTITIES. 
Each agency (as defined in such Executive Order 
issued on August 22, 2006, relating to promoting quality 
and efficient health care in Federal government adminis-
tered or sponsored health care programs) shall require in 
contracts or agreements with health care providers, health 
plans, or health insurance issuers that as each provider, 
plan, or issuer implements, acquires, or upgrades health 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
information technology systems, it shall utilize, where 
available, health information technology systems and prod-
ucts that meet standards and implementation specifica-
tions adopted under section 3004(b) of the Public Health 
Service Act, as added by section 101. 
SEC. 113. REPORTS. 
(a) IN GENERAL.—The Secretary of Health and 
Human Services shall submit to the Committee on Health, 
Education, Labor, and Pensions and the Committee on 
Commerce, Science, and Transportation of the Senate and 
the Committee on Energy and Commerce and the Com-
mittee on Science and Technology of the House of Rep-
resentatives, on an annual basis, a report that— 
(1) describes the specific actions that have been 
taken by the Federal Government and private enti-
ties to facilitate the adoption of an interoperable na-
tionwide system for the electronic exchange of health 
information; 
(2) describes barriers to the adoption of such a 
nationwide system; and 
(3) contains recommendations to achieve full 
implementation of such a nationwide system. 
(b) REIMBURSEMENT INCENTIVE STUDY.—The Sec-
retary of Health and Human Services shall carry out, or 
contract with a private entity to carry out, a study that 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
examines methods to create efficient reimbursement incen-
tives for improving health care quality in Federally quali-
fied health centers, rural health clinics, and free clinics. 
Subtitle B—Incentives for the Use 
of Health Information Technology 
SEC. 121. GRANT, LOAN, AND DEMONSTRATION PROGRAMS. 
Title XXX of the Public Health Service Act, as added 
by section 101, is amended by adding at the end the fol-
lowing new subtitle: 
‘‘Subtitle B—Incentives for the Use 
of Health Information Technology 
‘‘SEC. 3011. GRANTS AND LOANS TO FACILITATE THE WIDE-
SPREAD ADOPTION OF QUALIFIED HEALTH 
INFORMATION TECHNOLOGY. 
‘‘(a) COMPETITIVE GRANTS TO FACILITATE
THE 
WIDESPREAD
ADOPTION
OF
HEALTH
INFORMATION 
TECHNOLOGY.— 
‘‘(1) IN GENERAL.—The National Coordinator 
may award competitive grants to eligible entities to 
purchase qualified health information technology. 
‘‘(2) QUALIFIED HEALTH INFORMATION TECH-
NOLOGY.—For purposes of this section, the term 
‘qualified health information technology’ means 
health information technology that consists of hard-
VerDate Aug 31 2005 
20:50 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
ware, software, or the provision of support services 
and that— 
‘‘(A) enables the protection of health infor-
mation, in accordance with applicable law; 
‘‘(B) is (or is necessary for the operation 
of) an electronic health records system, includ-
ing the provision of decision support and physi-
cian order entry for medications; 
‘‘(C) has the ability to allow timely and 
permissible access to patient information and to 
transmit and exchange health information 
among providers, patients, or insurers; and 
‘‘(D) is certified under the program devel-
oped under section 3001(c)(9) to be in compli-
ance with any applicable standards and imple-
mentation specifications adopted under section 
3004(b). 
‘‘(3) ELIGIBILITY.—To be eligible to receive a 
grant under paragraph (1) an entity shall— 
‘‘(A) submit to the National Coordinator 
an application at such time and in such manner 
as the National Coordinator may require, and 
containing— 
‘‘(i) a plan on how the entity intends 
to maintain and support the qualified 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
health information technology that would 
be purchased with amounts under such 
grant, including the type of resources ex-
pected to be involved; and 
‘‘(ii) such other information as the 
National Coordinator may require; 
‘‘(B) submit to the National Coordinator a 
strategic plan for the electronic exchange and 
use of health information; 
‘‘(C) be— 
‘‘(i) a not for profit hospital or a Fed-
erally qualified health center (as defined in 
section 1861(aa)(4) of the Social Security 
Act); 
‘‘(ii) an individual or group practice; 
or 
‘‘(iii) another health care provider not 
described in clause (i) or (ii); 
‘‘(D) demonstrate significant financial 
need; 
‘‘(E) agree to notify individuals in accord-
ance with section 302 of the PRO(TECH)T Act 
of 2008 if their individually identifiable health 
information is accessed or acquired as a result 
of a breach; and 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘(F) provide matching funds in accordance 
with paragraph (5). 
‘‘(4) USE OF FUNDS.—Amounts received under 
a grant under this subsection shall be used to facili-
tate the purchase of qualified health information 
technology. 
‘‘(5) MATCHING REQUIREMENT.—To be eligible 
for a grant under this subsection an entity shall con-
tribute non-Federal contributions to the costs of car-
rying out the activities for which the grant is award-
ed in an amount equal to $1 for each $3 of Federal 
funds provided under the grant. 
‘‘(6) PREFERENCE IN AWARDING GRANTS.—In 
awarding grants under this subsection the National 
Coordinator shall give preference to the following eli-
gible entities: 
‘‘(A) Small health care providers. 
‘‘(B) Entities that are located in rural, 
frontier, and other areas that serve uninsured, 
underinsured, and medically underserved indi-
viduals (regardless of whether such area is 
urban, rural, or frontier). 
‘‘(C) Entities that will link, to the extent 
practicable, to local or regional health informa-
tion plan or plans. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘(D) Nonprofit health care providers. 
‘‘(7) ADDITIONAL SOURCES OF FUNDING FOR 
HEALTH
INFORMATION
TECHNOLOGY.—Funding 
made available under this subsection is in addition 
to funding which may be used toward the acquisition 
and utilization of health information technology 
under other law, which includes the following: 
‘‘(A) 
Medicaid 
transformation 
grants 
under section 1903(z) of the Social Security 
Act. 
‘‘(B) Grants or funding available through 
the Agency for Healthcare Research and Qual-
ity. 
‘‘(C) Grants or funding that may be avail-
able through the Health Resources and Services 
Administration for investment in health infor-
mation technologies or telehealth. 
‘‘(D) Grants or funding that may be avail-
able through the Department of Agriculture’s 
Rural Development Telecommunications Pro-
gram for investment in telemedicine. 
‘‘(b) COMPETITIVE GRANTS TO STATES AND INDIAN 
TRIBES FOR THE DEVELOPMENT OF LOAN PROGRAMS TO 
FACILITATE THE WIDESPREAD ADOPTION OF QUALIFIED 
HEALTH INFORMATION TECHNOLOGY.— 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘(1) IN GENERAL.—The National Coordinator 
may award competitive grants to eligible entities for 
the establishment of programs for loans to health 
care providers to purchase qualified health informa-
tion technology. 
‘‘(2) ELIGIBLE
ENTITY
DEFINED.—For pur-
poses of this subsection, the term ‘eligible entity’ 
means a State or Indian tribe (as defined in the In-
dian Self-Determination and Education Assistance 
Act) that— 
‘‘(A) submits to the National Coordinator 
an application at such time, in such manner, 
and containing such information as the Na-
tional Coordinator may require; 
‘‘(B) submits to the National Coordinator 
a strategic plan in accordance with paragraph 
(4) and provides to the National Coordinator 
assurances that the entity will update such plan 
annually in accordance with such paragraph; 
‘‘(C) provides assurances to the National 
Coordinator that the entity will establish a 
Loan Fund in accordance with paragraph (3); 
‘‘(D) provides assurances to the National 
Coordinator that the entity will not provide a 
loan from the Loan Fund to a health care pro-
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
vider unless the provider meets each of the con-
ditions described in paragraph (5); and 
‘‘(E) agrees to provide matching funds in 
accordance with paragraph (9). 
‘‘(3) ESTABLISHMENT OF FUND.—For purposes 
of paragraph (3)(C), an eligible entity shall establish 
a qualified health information technology loan fund 
(referred to in this subsection as a ‘Loan Fund’) 
and comply with the other requirements contained in 
this section. A grant to an eligible entity under this 
subsection shall be deposited in the Loan Fund es-
tablished by the eligible entity. No funds authorized 
by other provisions of this subtitle to be used for 
other purposes specified in this subtitle shall be de-
posited in any Loan Fund. 
‘‘(4) STRATEGIC PLAN.— 
‘‘(A) IN GENERAL.—For purposes of para-
graph (3)(B), a strategic plan of an eligible en-
tity under this paragraph shall identify the in-
tended uses of amounts available to the Loan 
Fund of such entity. 
‘‘(B) CONTENTS.—A strategic plan under 
subparagraph (A), with respect to a Loan Fund 
of an eligible entity, shall include for a year the 
following: 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘(i) A list of the projects to be as-
sisted through the Loan Fund during such 
year. 
‘‘(ii) A description of the criteria and 
methods established for the distribution of 
funds from the Loan Fund during the 
year. 
‘‘(iii) A description of the financial 
status of the Loan Fund as of the date of 
submission of the plan. 
‘‘(iv) The short-term and long-term 
goals of the Loan Fund. 
‘‘(5) HEALTH CARE PROVIDER CONDITIONS FOR 
RECEIPT
OF
LOANS.—For purposes of paragraph 
(2)(D), the conditions described in this paragraph, 
with respect to a health care provider that seeks a 
loan from a Loan Fund established under this sub-
section, are the following: 
‘‘(A) The health care provider links, to the 
extent practicable, to a local or regional health 
information network. 
‘‘(B) The health care provider consults 
with the Health Information Technology Re-
source Center established under section 3007 to 
access the knowledge and experience of existing 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
initiatives regarding the successful implementa-
tion and effective use of health information 
technology. 
‘‘(C) The health care provider agrees to 
notify individuals in accordance with section 
302 of the PRO(TECH)T Act of 2008 if their 
individually identifiable health information is 
accessed or acquired as a result of a breach. 
‘‘(D) The health care provider submits to 
the State or Indian tribe involved a plan on how 
the health care provider intends to maintain 
and support the qualified health information 
technology that would be purchased with such 
loan, including the type of resources expected to 
be involved and any such other information as 
the State or Indian Tribe, respectively, may re-
quire. 
‘‘(6) USE OF FUNDS.— 
‘‘(A) IN GENERAL.—Amounts deposited in 
a Loan Fund, including loan repayments and 
interest earned on such amounts, shall be used 
only for awarding loans or loan guarantees, or 
as a source of reserve and security for leveraged 
loans, the proceeds of which are deposited in 
the Loan Fund established under paragraph 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
(1). Loans under this section may be used by 
a health care provider to purchase qualified 
health information technology. 
‘‘(B) LIMITATION.—Amounts received by 
an eligible entity under this subsection may not 
be used— 
‘‘(i) for the purchase or other acquisi-
tion of any health information technology 
system that is not a qualified health infor-
mation technology; 
‘‘(ii) to conduct activities for which 
Federal funds are expended under this 
title; or 
‘‘(iii) for any purpose other than mak-
ing loans to health care providers in ac-
cordance with this section. 
‘‘(7) TYPES OF ASSISTANCE.—Except as other-
wise limited by applicable State law, amounts depos-
ited into a Loan Fund under this subsection may 
only be used for the following: 
‘‘(A) To award loans that comply with the 
following: 
‘‘(i) The interest rate for each loan 
shall not exceed the market interest rate. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘(ii) The principal and interest pay-
ments on each loan shall commence not 
later than 1 year after the date the loan 
was awarded, and each loan shall be fully 
amortized not later than 10 years after the 
date of the loan. 
‘‘(iii) The Loan Fund shall be cred-
ited with all payments of principal and in-
terest on each loan awarded from the Loan 
Fund. 
‘‘(B) To guarantee, or purchase insurance 
for, a local obligation (all of the proceeds of 
which finance a project eligible for assistance 
under this subsection) if the guarantee or pur-
chase would improve credit market access or re-
duce the interest rate applicable to the obliga-
tion involved. 
‘‘(C) As a source of revenue or security for 
the payment of principal and interest on rev-
enue or general obligation bonds issued by the 
eligible entity if the proceeds of the sale of the 
bonds will be deposited into the Loan Fund. 
‘‘(D) To earn interest on the amounts de-
posited into the Loan Fund. 
‘‘(8) ADMINISTRATION OF LOAN FUNDS.— 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘(A) COMBINED FINANCIAL ADMINISTRA-
TION.—An eligible entity may (as a convenience 
and to avoid unnecessary administrative costs) 
combine, in accordance with applicable State 
law, the financial administration of a Loan 
Fund established under this subsection with the 
financial administration of any other revolving 
fund established by the entity if otherwise not 
prohibited by the law under which the Loan 
Fund was established. 
‘‘(B) COST
OF
ADMINISTERING
FUND.— 
Each eligible entity may annually use not to ex-
ceed 4 percent of the funds provided to the en-
tity under a grant under this subsection to pay 
the reasonable costs of the administration of 
the programs under this section, including the 
recovery of reasonable costs expended to estab-
lish a Loan Fund which are incurred after the 
date of the enactment of this title. 
‘‘(C) GUIDANCE AND REGULATIONS.—The 
National Coordinator shall publish guidance 
and promulgate regulations as may be nec-
essary to carry out the provisions of this sub-
section, including— 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘(i) provisions to ensure that each eli-
gible entity commits and expends funds al-
lotted to the entity under this subsection 
as efficiently as possible in accordance with 
this title and applicable State laws; and 
‘‘(ii) guidance to prevent waste, fraud, 
and abuse. 
‘‘(D) PRIVATE SECTOR CONTRIBUTIONS.— 
‘‘(i) IN GENERAL.—A Loan Fund es-
tablished under this subsection may accept 
contributions from private sector entities, 
except that such entities may not specify 
the recipient or recipients of any loan 
issued under this subsection. An eligible 
entity may agree to reimburse a private 
sector entity for any contribution made 
under this subparagraph, except that the 
amount of such reimbursement may not be 
greater than the principal amount of the 
contribution made. 
‘‘(ii) 
AVAILABILITY
OF
INFORMA-
TION.—An eligible entity shall make pub-
licly available the identity of, and amount 
contributed by, any private sector entity 
under clause (i) and may issue letters of 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
commendation or make other awards (that 
have no financial value) to any such entity. 
‘‘(9) MATCHING REQUIREMENTS.— 
‘‘(A) IN GENERAL.—The National Coordi-
nator may not make a grant under paragraph 
(1) to an eligible entity unless the entity agrees 
to make available (directly or through donations 
from public or private entities) non-Federal 
contributions in cash to the costs of carrying 
out the activities for which the grant is awarded 
in an amount equal to not less than $1 for each 
$1 of Federal funds provided under the grant. 
‘‘(B) DETERMINATION
OF
AMOUNT
OF 
NON-FEDERAL CONTRIBUTION.—In determining 
the amount of non-Federal contributions that 
an eligible entity has provided pursuant to sub-
paragraph (A), the National Coordinator may 
not include any amounts provided to the entity 
by the Federal Government. 
‘‘(10) REPORTS.—The National Coordinator 
shall annually submit to the Committee on Health, 
Education, Labor, and Pensions and the Committee 
on Finance of the Senate, and the Committee on 
Energy and Commerce of the House of Representa-
tives, a report summarizing the reports received by 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
the National Coordinator from each eligible entity 
that receives a grant under this subsection. 
‘‘(c) COMPETITIVE GRANTS FOR THE IMPLEMENTA-
TION OF REGIONAL OR LOCAL HEALTH INFORMATION 
TECHNOLOGY PLANS.— 
‘‘(1) IN GENERAL.—The National Coordinator 
may award competitive grants to eligible entities to 
implement regional or local health information plans 
to improve health care quality and efficiency through 
the electronic exchange and use of health informa-
tion. 
‘‘(2) ELIGIBILITY.—To be eligible to receive a 
grant under paragraph (1) an entity shall— 
‘‘(A) facilitate the electronic exchange and 
use of health information within the local or re-
gional area and among local and regional areas; 
‘‘(B) demonstrate financial need to the Na-
tional Coordinator; 
‘‘(C) demonstrate that one of its principal 
missions or purposes is to use information tech-
nology to improve health care quality and effi-
ciency; 
‘‘(D) adopt bylaws, memoranda of under-
standing, or other charter documents that dem-
onstrate that the governance structure and de-
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
cisionmaking processes of such entity allow for 
participation on an ongoing basis by multiple 
stakeholders within a community, including— 
‘‘(i) physicians (as defined in section 
1861(r) of the Social Security Act), includ-
ing physicians that provide services to low 
income populations and populations that 
are uninsured, underinsured, and medically 
underserved (including such populations in 
urban and rural areas); 
‘‘(ii) hospitals (including hospitals 
that provide services to low income and un-
derserved populations); 
‘‘(iii) pharmacists and pharmacies; 
‘‘(iv) health plans; 
‘‘(v) health centers (as defined in sec-
tion 330(b)) and Federally qualified health 
centers (as defined in section 1861(aa)(4) 
of the Social Security Act); 
‘‘(vi) rural health clinics (as defined in 
section 1861(aa) of the Social Security 
Act); 
‘‘(vii) patient or consumer organiza-
tions that reflect the population to be 
served; 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘(viii) employers; 
‘‘(ix) public health agencies; and 
‘‘(x) such other health care providers 
or other entities, as determined appro-
priate by the National Coordinator; 
‘‘(E) demonstrate the participation, to the 
extent practicable, of stakeholders in the elec-
tronic exchange and use of health information 
within the local or regional health information 
plan pursuant to subparagraph (D); 
‘‘(F) adopt nondiscrimination and conflict 
of interest policies that demonstrate a commit-
ment to open, fair, and nondiscriminatory par-
ticipation in the regional or local health infor-
mation plan by all stakeholders; 
‘‘(G) comply with applicable standards and 
implementation specifications adopted under 
subtitle A of this title; 
‘‘(H) prepare and submit to the National 
Coordinator an application in accordance with 
paragraph (3); and 
‘‘(I) agree to provide matching funds in ac-
cordance with paragraph (6). 
‘‘(3) APPLICATION.— 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘(A) IN GENERAL.—To be eligible to re-
ceive a grant under paragraph (1), an entity 
shall submit to the National Coordinator an ap-
plication at such time, in such manner, and 
containing such information (in addition to in-
formation required under subparagraph (B), as 
the National Coordinator may require. 
‘‘(B) 
REQUIRED
INFORMATION.—At 
a 
minimum, an application submitted under this 
paragraph shall include— 
‘‘(i) clearly identified short-term and 
long-term objectives of the regional or local 
health information plan; 
‘‘(ii) an estimate of costs of the hard-
ware, software, training, and other services 
necessary to implement the regional or 
local health information plan; 
‘‘(iii) a strategy that includes initia-
tives to improve health care quality and ef-
ficiency; 
‘‘(iv) a plan that describes provisions 
to encourage the electronic exchange and 
use of health information by all physicians, 
including single physician practices and 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
small physician groups, participating in the 
health information plan; 
‘‘(v) a plan to ensure the privacy and 
security of individually identifiable health 
information that is consistent with applica-
ble Federal and State law; 
‘‘(vi) a governance plan that defines 
the manner in which the stakeholders shall 
jointly make policy and operational deci-
sions on an ongoing basis; 
‘‘(vii) a financial or business plan that 
describes— 
‘‘(I) the sustainability of the 
plan; 
‘‘(II) the financial costs and ben-
efits of the plan; and 
‘‘(III) the entities to which such 
costs and benefits will accrue; 
‘‘(viii) a plan on how the entity in-
volved intends to maintain and support the 
regional or local health information plan, 
including the type of resources expected to 
be involved; and 
‘‘(ix) in the case of an applicant that 
is unable to demonstrate the participation 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
of all stakeholders pursuant to paragraph 
(2)(D), the justification from the entity for 
any such nonparticipation. 
‘‘(4) USE OF FUNDS.—Amounts received under 
a grant under paragraph (1) shall be used to estab-
lish and implement a regional or local health infor-
mation plan in accordance with this subsection. 
‘‘(5) PREFERENCE.—In awarding grants under 
paragraph (1), the Secretary shall give preference to 
eligible entities that intend to use amounts received 
under a grant to establish or implement a regional 
or local health information plan that encompasses 
communities with health disparities or areas that 
serve uninsured, underinsured, and medically under-
served individuals (including urban and rural areas). 
‘‘(6) MATCHING REQUIREMENT.— 
‘‘(A) IN GENERAL.—The National Coordi-
nator may not make a grant under this sub-
section to an entity unless the entity agrees 
that, with respect to the costs of carrying out 
the activities for which the grant is awarded, 
the entity will make available (directly or 
through donations from public or private enti-
ties) non-Federal contributions toward such 
costs in an amount equal to not less than 50 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
percent of such costs ($1 for each $2 of Federal 
funds provided under the grant). 
‘‘(B) DETERMINATION
OF
AMOUNT
CON-
TRIBUTED.—Non-Federal 
contributions 
re-
quired under subparagraph (A) may be in cash 
or in kind, fairly evaluated, including equip-
ment, technology, or services. Amounts provided 
by the Federal Government, or services assisted 
or subsidized to any significant extent by the 
Federal Government, may not be included in 
determining the amount of such non-Federal 
contributions. 
‘‘(d) REPORTS.—Not later than 1 year after the date 
on which the first grant is awarded under this section, 
and annually thereafter during the grant period, an entity 
that receives a grant under this section shall submit to 
the National Coordinator a report on the activities carried 
out under the grant involved. Each such report shall in-
clude— 
‘‘(1) a description of the financial costs and 
benefits of the project involved and of the entities to 
which such costs and benefits accrue; 
‘‘(2) an analysis of the impact of the project on 
health care quality and safety; 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘(3) a description of any reduction in duplica-
tive or unnecessary care as a result of the project in-
volved; 
‘‘(4) a description of the efforts of recipients 
under this section to facilitate secure patient access 
to health information; 
‘‘(5) an analysis of the effectiveness of the 
project involved on ensuring the privacy and security 
of individually identifiable health information in ac-
cordance with applicable Federal and State law; and 
‘‘(6) other information as required by the Na-
tional Coordinator. 
‘‘(e) REQUIREMENT TO IMPROVE QUALITY OF CARE 
AND DECREASE IN COSTS.—The National Coordinator 
shall annually evaluate the activities conducted under this 
section and shall, in awarding grants, implement the les-
sons learned from such evaluation in a manner so that 
awards made subsequent to each such evaluation are made 
in a manner that, in the determination of the National 
Coordinator, will result in the greatest improvement in 
quality of care and decrease in costs. 
‘‘(f) LIMITATION.—An eligible entity may only receive 
one non-renewable grant under subsection (a), one non- 
renewable grant under subsection (b), and one non-renew-
able grant under subsection (c). 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘(g) SMALL HEALTH CARE PROVIDER.—For pur-
poses of this section, the term ‘small health care provider’ 
means a health care provider that has an average of 10 
or fewer full-time equivalent employees during the period 
involved. 
‘‘(h) AUTHORIZATION OF APPROPRIATIONS.— 
‘‘(1) IN
GENERAL.—For the purpose of car-
rying out subsections (a) through (d), there is au-
thorized to be appropriated $115,000,000 for each 
of the fiscal years 2009 through 2013. 
‘‘(2) 
AVAILABILITY.—Amounts 
appropriated 
under paragraph (1) shall remain available through 
fiscal year 2013. 
‘‘SEC. 3012. DEMONSTRATION PROGRAM TO INTEGRATE IN-
FORMATION TECHNOLOGY INTO CLINICAL 
EDUCATION. 
‘‘(a) IN GENERAL.—The Secretary may award grants 
under this section to carry out demonstration projects to 
develop academic curricula integrating qualified health in-
formation technology in the clinical education of health 
professionals. Such awards shall be made on a competitive 
basis and pursuant to peer review. 
‘‘(b) ELIGIBILITY.—To be eligible to receive a grant 
under subsection (a), an entity shall— 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘(1) submit to the Secretary an application at 
such time, in such manner, and containing such in-
formation as the Secretary may require; 
‘‘(2) submit to the Secretary a strategic plan 
for integrating qualified health information tech-
nology in the clinical education of health profes-
sionals to reduce medical errors and enhance health 
care quality; 
‘‘(3) be— 
‘‘(A) a school of medicine, osteopathic 
medicine, dentistry, or pharmacy, or a graduate 
program in behavioral or mental health; 
‘‘(B) a graduate school of nursing or phy-
sician assistant studies; 
‘‘(C) a consortium of two or more schools 
described in subparagraph (A) or (B); or 
‘‘(D) an institution with a graduate med-
ical education program in medicine, osteopathic 
medicine, dentistry, pharmacy, nursing, or phy-
sician assistance studies. 
‘‘(4) provide for the collection of data regarding 
the effectiveness of the demonstration project to be 
funded under the grant in improving the safety of 
patients, the efficiency of health care delivery, and 
in increasing the likelihood that graduates of the 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
grantee will adopt and incorporate qualified health 
information technology, in the delivery of health care 
services; and 
‘‘(5) provide matching funds in accordance with 
subsection (d). 
‘‘(c) USE OF FUNDS.— 
‘‘(1) IN GENERAL.—With respect to a grant 
under subsection (a), an eligible entity shall— 
‘‘(A) use grant funds in collaboration with 
2 or more disciplines; and 
‘‘(B) use grant funds to integrate qualified 
health information technology into community- 
based clinical education. 
‘‘(2) LIMITATION.—An eligible entity shall not 
use amounts received under a grant under sub-
section (a) to purchase hardware, software, or serv-
ices. 
‘‘(d) MATCHING FUNDS.— 
‘‘(1) IN GENERAL.—The Secretary may award 
a grant to an entity under this section only if the 
entity agrees to make available non-Federal con-
tributions toward the costs of the program to be 
funded under the grant in an amount that is not 
less than $1 for each $2 of Federal funds provided 
under the grant. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘(2) DETERMINATION
OF
AMOUNT
CONTRIB-
UTED.—Non-Federal contributions under paragraph 
(1) may be in cash or in kind, fairly evaluated, in-
cluding equipment or services. Amounts provided by 
the Federal Government, or services assisted or sub-
sidized to any significant extent by the Federal Gov-
ernment, may not be included in determining the 
amount of such contributions. 
‘‘(e) EVALUATION.—The Secretary shall take such 
action as may be necessary to evaluate the projects funded 
under this section and publish, make available, and dis-
seminate the results of such evaluations on as wide a basis 
as is practicable. 
‘‘(f) REPORTS.—Not later than 1 year after the date 
of enactment of this title, and annually thereafter, the Sec-
retary shall submit to the Committee on Health, Edu-
cation, Labor, and Pensions and the Committee on Fi-
nance of the Senate, and the Committee on Energy and 
Commerce of the House of Representatives a report 
that— 
‘‘(1) describes the specific projects established 
under this section; and 
‘‘(2) contains recommendations for Congress 
based on the evaluation conducted under subsection 
(e). 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘(g) AUTHORIZATION OF APPROPRIATIONS.—There 
is authorized to be appropriated to carry out this section, 
$10,000,000 for each of fiscal years 2009 through 2011. 
‘‘(h) SUNSET.—This section shall not apply after 
September 30, 2011.’’. 
TITLE II—TESTING OF HEALTH 
INFORMATION TECHNOLOGY 
SEC. 201. NATIONAL INSTITUTE FOR STANDARDS AND 
TECHNOLOGY TESTING. 
(a) PILOT TESTING OF STANDARDS AND IMPLEMEN-
TATION SPECIFICATIONS.—In coordination with the HIT 
Standards Committee established under section 3003 of 
the Public Health Service Act, as added by section 101, 
with respect to the development of standards and imple-
mentation specifications under such section, the Director 
of the National Institute for Standards and Technology 
shall test such standards and specifications in order to as-
sure the efficient implementation and use of such stand-
ards and specifications. 
(b) VOLUNTARY TESTING PROGRAM.—In coordina-
tion with the HIT Standards Committee established under 
section 3003 of the Public Health Service Act, as added 
by section 101, with respect to the development of stand-
ards and implementation specifications under such sec-
tion, the Director of the National Institute of Standards 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
and Technology shall support the establishment of a con-
formance testing infrastructure, including the develop-
ment of technical test beds. The development of this con-
formance testing infrastructure may include a program to 
accredit independent, non-Federal laboratories to perform 
testing. 
SEC. 202. RESEARCH AND DEVELOPMENT PROGRAMS. 
(a) HEALTH CARE INFORMATION ENTERPRISE INTE-
GRATION RESEARCH CENTERS.— 
(1) IN GENERAL.—The Director of the National 
Institute of Standards and Technology, in consulta-
tion the Director of the National Science Foundation 
and other appropriate Federal agencies, shall estab-
lish a program of assistance to institutions of higher 
education (or consortia thereof which may include 
nonprofit entities and Federal Government labora-
tories) to establish multidisciplinary Centers for 
Health Care Information Enterprise Integration. 
(2) REVIEW; COMPETITION.—Grants shall be 
awarded under this subsection on a merit-reviewed, 
competitive basis. 
(3) PURPOSE.—The purposes of the Centers de-
scribed in paragraph (1) shall be— 
(A) to generate innovative approaches to 
health care information enterprise integration 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
by conducting cutting-edge, multidisciplinary 
research on the systems challenges to health 
care delivery; and 
(B) the development and use of health in-
formation technologies and other complemen-
tary fields. 
(4) RESEARCH AREAS.—Research areas may in-
clude— 
(A) interfaces between human information 
and communications technology systems; 
(B) voice-recognition systems; 
(C) software that improves interoperability 
and connectivity among health information sys-
tems; 
(D) software dependability in systems crit-
ical to health care delivery; 
(E) measurement of the impact of informa-
tion technologies on the quality and productivity 
of health care; 
(F) health information enterprise manage-
ment; 
(G) health information technology security 
and integrity; and 
(H) relevant health information technology 
to reduce medical errors. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
(5) APPLICATIONS.—An institution of higher 
education (or a consortium thereof) seeking funding 
under this subsection shall submit an application to 
the Director of the National Institute of Standards 
and Technology at such time, in such manner, and 
containing such information as the Director may re-
quire. The application shall include, at a minimum, 
a description of— 
(A) the research projects that will be un-
dertaken by the Center established pursuant to 
assistance under paragraph (1) and the respec-
tive contributions of the participating entities; 
(B) how the Center will promote active col-
laboration among scientists and engineers from 
different disciplines, such as information tech-
nology, biologic sciences, management, social 
sciences, and other appropriate disciplines; 
(C) technology transfer activities to dem-
onstrate and diffuse the research results, tech-
nologies, and knowledge; and 
(D) how the Center will contribute to the 
education and training of researchers and other 
professionals in fields relevant to health infor-
mation enterprise integration. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
(b) NATIONAL
INFORMATION
TECHNOLOGY
RE-
SEARCH AND DEVELOPMENT PROGRAM.—The National 
High-Performance Computing Program established by 
section 101 of the High-Performance Computing Act of 
1991 (15 U.S.C. 5511) shall coordinate Federal research 
and development programs related to the development and 
deployment of health information technology, including ac-
tivities related to— 
(1) computer infrastructure; 
(2) data security; 
(3) development of large-scale, distributed, reli-
able computing systems; 
(4) wired, wireless, and hybrid high-speed net-
working; 
(5) development of software and software-inten-
sive systems; 
(6) human-computer interaction and informa-
tion management technologies; and 
(7) the social and economic implications of in-
formation technology. 
TITLE III—PRIVACY AND 
SECURITY PROVISIONS 
SEC. 300. DEFINITIONS. 
In this title, except as specified otherwise: 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
(1) BREACH.—The term ‘‘breach’’ means the 
unauthorized acquisition or disclosure of protected 
health information which compromises the security, 
privacy, or integrity of protected health information 
maintained by or on behalf of a person. Such term 
does not include any unintentional acquisition of 
such information by an employee or agent of the 
covered entity or business associate involved if such 
acquisition was made in good faith and within the 
course and scope of the employment or other con-
tractual relationship of such employee or agent, re-
spectively, with the covered entity or business asso-
ciate and if such information is not further acquired, 
used, or disclosed by such employee or agent. 
(2) BUSINESS ASSOCIATE.—The term ‘‘business 
associate’’ has the meaning given such term in sec-
tion 160.103 of title 45, Code of Federal Regula-
tions. 
(3) COVERED ENTITY.—The term ‘‘covered en-
tity’’ has the meaning given such term in section 
160.103 of title 45, Code of Federal Regulations. 
(4) DISCLOSE.—The terms ‘‘disclose’’ and ‘‘dis-
closure’’ have the meaning given the term ‘‘disclo-
sure’’ in section 160.103 of title 45, Code of Federal 
Regulations. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
(5) ENCRYPTION.—The term ‘‘encryption’’ has 
the meaning given such term in section 164.304 of 
title 45, Code of Federal Regulations. 
(6) HEALTH
CARE
OPERATIONS.—The term 
‘‘health care operation’’ has the meaning given such 
term in section 164.501 of title 45, Code of Federal 
Regulations. 
(7) HEALTH
CARE
PROVIDER.—The term 
‘‘health care provider’’ has the meaning given such 
term in section 160.103 of title 45, Code of Federal 
Regulations. 
(8) PERSONAL
HEALTH
RECORD.—The term 
‘‘personal health record’’ means an electronic record 
of individually identifiable health information on an 
individual that is drawn from multiple sources and 
that is managed, shared, and controlled by or for the 
individual. 
(9) PROTECTED HEALTH INFORMATION.—The 
term ‘‘protected health information’’ has the mean-
ing given such term under section 160.103 of title 
45, Code of Federal Regulations. 
(10) 
SECRETARY.—The 
term 
‘‘Secretary’’ 
means the Secretary of Health and Human Services. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
(11) SECURITY.—The term ‘‘security’’ has the 
meaning given such term in section 164.304 of title 
45, Code of Federal Regulations. 
(12) STATE.—The term ‘‘State’’ means each of 
the several States, the District of Columbia, Puerto 
Rico, the Virgin Islands, Guam, American Samoa, 
and the Northern Mariana Islands. 
(13) USE.—The term ‘‘use’’ has the meaning 
given such term in section 160.103 of title 45, Code 
of Federal Regulations. 
(14) 
VENDOR
OF
PERSONAL
HEALTH 
RECORDS.—The term ‘‘vendor’’ means an entity that 
offers or maintains a personal health record and 
that is not a covered entity. 
Subtitle A—Security Provisions 
SEC. 301. APPLICATION OF SECURITY PROVISIONS AND 
PENALTIES TO BUSINESS ASSOCIATES OF 
COVERED ENTITIES; ANNUAL GUIDANCE ON 
SECURITY PROVISIONS. 
(a) APPLICATION OF SECURITY PROVISIONS.—Sec-
tions 164.308, 164.310, and 164.312 of title 45, Code of 
Federal Regulations, shall apply to a business associate 
of a covered entity in the same manner that such sections 
apply to the covered entity. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
(b) APPLICATION
OF CIVIL
AND CRIMINAL PEN-
ALTIES.—Sections 1176 and 1177 of the Social Security 
Act (42 U.S.C. 1320d–5, 1320d–6) shall apply to a busi-
ness associate of a covered entity with respect to a section 
applied under subsection (a) to such business associate in 
the same manner that such sections apply to a covered 
entity with respect to such section. 
(c) ANNUAL GUIDANCE.—For the first year begin-
ning after the date of the enactment of this Act and annu-
ally thereafter, the Secretary of Health and Human Serv-
ices shall, in consultation with industry stakeholders, an-
nually issue guidance on the latest safeguard technologies 
for use in carrying out the sections described in subsection 
(a). 
SEC. 302. NOTIFICATION IN THE CASE OF BREACH. 
(a) IN GENERAL.—A covered entity that accesses, 
maintains, retains, modifies, records, stores, destroys, or 
otherwise holds, uses, or discloses unencrypted protected 
health information (as defined in subsection (h)) shall, in 
the case of a breach of such information that is discovered 
by the covered entity, notify each individual whose 
unencrypted protected health information has been, or is 
reasonably believed by the covered entity to have been, 
accessed or acquired as a result of such breach. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
(b) NOTIFICATION OF COVERED ENTITY BY BUSI-
NESS ASSOCIATE.—A business associate of a covered enti-
ty that accesses, maintains, retains, modifies, records, 
stores, destroys, or otherwise holds, uses, or discloses 
unencrypted protected health information shall, following 
the discovery of a breach of such information, notify the 
covered entity of such breach. Such notice shall include 
the identification of each individual whose unencrypted 
protected health information has been, or is reasonably be-
lieved to have been, accessed or acquired during such 
breach. 
(c) BREACHES TREATED AS DISCOVERED.—For pur-
poses of this section, a breach shall be treated as discov-
ered by a covered entity or by a business associate as of 
the first day on which such breach is known to such entity 
or associate, respectively, (including any person that is an 
employee, officer, or other agent of such entity or asso-
ciate, respectively) or should reasonably have been known 
to such entity or associate (or person) to have occurred. 
(d) TIMELINESS OF NOTIFICATION.— 
(1) IN
GENERAL.—All notifications required 
under this section shall be made without unreason-
able delay and in no case later than 60 calendar 
days after the discovery of a breach by the covered 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
entity involved (or business associate involved in the 
case of a notification required under subsection (b)). 
(2) BURDEN OF PROOF.—The covered entity in-
volved (or business associate involved in the case of 
a notification required under subsection (b)), shall 
have the burden of demonstrating that all notifica-
tions were made as required under this subtitle, in-
cluding evidence demonstrating the necessity of any 
delay. 
(e) METHODS OF NOTICE.— 
(1) 
INDIVIDUAL
NOTICE.—Notice 
required 
under this section to be provided to an individual, 
with respect to a breach, shall be provided promptly 
and in the following form: 
(A) Written notification by first-class mail 
to the individual (or the next of kin of the indi-
vidual if the individual is deceased) at the last 
known address of the individual or the next of 
kin, respectively, or, if specified as a preference 
by the individual, by electronic mail. The notifi-
cation may be provided in one or more mailings 
as information is available. 
(B) In the case where there is insufficient, 
or out-of-date contact information that pre-
cludes direct written (or, if specified by the in-
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
dividual under subparagraph (A), electronic) 
notification to the individual, a substitute form 
of notice shall be provided, including a con-
spicuous posting on the home page of the Web 
site of the covered entity involved or notice in 
major print or broadcast media, including 
major media in geographic areas where the in-
dividuals affected by the breach likely reside. 
Such a notice in media will include a toll-free 
phone number where an individual can learn 
whether or not the individual’s unencrypted 
protected health information is possibly in-
cluded in the breach. 
(C) In any case deemed by the covered en-
tity involved to require urgency because of pos-
sible imminent misuse of unencrypted protected 
health information, the covered entity, in addi-
tion to notice provided under subparagraph (A), 
may provide information to individuals by tele-
phone or other means, as appropriate. 
(2) MEDIA NOTICE.—Notice shall be provided 
to prominent media outlets serving a State or juris-
diction, following the discovery of a breach described 
in subsection (a), if the unencrypted protected 
health information of more than 500 residents of 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
such State or jurisdiction is, or is reasonably be-
lieved to have been, accessed or acquired during 
such breach. 
(3) NOTICE TO SECRETARY.—Notice shall be 
provided to the Secretary by covered entities of 
unencrypted protected health information that has 
been acquired or disclosed in a breach. 
(4) POSTING ON HHS PUBLIC WEBSITE.—The 
Secretary shall make available to the public on the 
Internet website of the Department of Health and 
Human Services a list that identifies each covered 
entity involved in a breach described in subsection 
(a) in which the unencrypted protected health infor-
mation of more than 1,000 individuals is acquired or 
disclosed. 
(f) CONTENT OF NOTIFICATION.—Regardless of the 
method by which notice is provided to individuals under 
this section, notice of a breach shall include, to the extent 
possible, the following: 
(1) A brief description of what happened, in-
cluding the date of the breach and the date of the 
discovery of the breach, if known. 
(2) A description of the types of unencrypted 
protected health information that were involved in 
the breach (such as full name, Social Security num-
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
ber, date of birth, home address, account number, or 
disability code). 
(3) The steps individuals should take to protect 
themselves from potential harm resulting from the 
breach. 
(4) A brief description of what the covered enti-
ty involved is doing to investigate the breach, to 
mitigate losses, and to protect against any further 
breaches. 
(5) Contact procedures for individuals to ask 
questions or learn additional information, which 
shall include a toll-free telephone number, an e-mail 
address, Web site, or postal address. 
(g) DELAY OF NOTIFICATION AUTHORIZED FOR LAW 
ENFORCEMENT PURPOSES.—If a law enforcement official 
determines that a notification, notice, or posting required 
under this section would impede a criminal investigation 
or cause damage to national security, such notification, 
notice, or posting shall be delayed in the same manner 
as provided under section 164.528(a)(2) of title 45, Code 
of Federal Regulations, in the case of a disclosure covered 
under such section. 
(h) UNENCRYPTED PROTECTED HEALTH INFORMA-
TION DEFINED.—For purposes of this section, the term 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00080
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
‘‘unencrypted protected health information’’ means pro-
tected health information that is not protected— 
(1) through the use of encryption; or 
(2) through the use of a technology specified by 
the Secretary as being at least as effective as 
encryption for purposes of rendering protected 
health information indecipherable without authoriza-
tion. 
SEC. 303. EDUCATION ON HEALTH INFORMATION PRIVACY 
AND REPORT ON COMPLIANCE. 
(a) REGIONAL OFFICE PRIVACY ADVISORS.—Not 
later than 6 months after the date of the enactment of 
this Act, the Secretary shall designate an individual in 
each regional office of the Department of Health and 
Human Services to offer guidance and education to cov-
ered entities, business associates, and individuals on their 
rights and responsibilities related to Federal privacy re-
quirements for protected health information. 
(b) REPORT ON COMPLIANCE.— 
(1) IN GENERAL.—For the first year beginning 
after the date of the enactment of this Act and an-
nually thereafter, the Secretary shall prepare and 
submit to Congress a report concerning complaints 
of alleged violations of the provisions of sections 301 
and 302, the provisions of subtitle B, and the provi-
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
sions of subparts C and E of title 45, Code of Fed-
eral Regulations that are received by the Secretary 
during the year for which the report is being pre-
pared. Each such report shall include, with respect 
to such complaints received during the year— 
(A) the number of such complaints; 
(B) the resolution or disposition of such 
complaints; 
(C) the amount of civil money penalties 
imposed with respect to such complaints, as ap-
plicable; 
(D) the number of compliance reviews con-
ducted and the outcome of each such review; 
(E) the number of subpoenas or inquiries 
issued; and 
(F) the Secretary’s plan for improving 
compliance with and enforcement of such provi-
sions for the following year. 
(2) AVAILABILITY
TO
PUBLIC.—Each report 
under paragraph (1) shall be made available to the 
public on the Internet website of the Department of 
Health and Human Services. 
(c) EDUCATION INITIATIVE ON USES OF HEALTH IN-
FORMATION.— 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
(1) IN GENERAL.—The Office for Civil Rights 
within the Department of Health and Human Serv-
ices shall develop and maintain a multi-faceted na-
tional education initiative to enhance public trans-
parency regarding the uses of protected health infor-
mation, including programs to educate individuals 
about the potential uses of their health information 
and effects of such uses. Such programs shall be 
conducted in a variety of languages and present in-
formation in a clear and understandable manner. 
(2) AUTHORIZATION
OF
APPROPRIATIONS.— 
There is authorized to be appropriated to carry out 
paragraph (1), $10,000,000 for the period of fiscal 
years 2009 through 2013. 
Subtitle B—Improved Privacy Pro-
visions and Additional Security 
Provisions 
SEC. 311. APPLICATION OF PENALTIES TO BUSINESS ASSO-
CIATES OF COVERED ENTITIES FOR VIOLA-
TIONS OF PRIVACY CONTRACT REQUIRE-
MENTS. 
(a) APPLICATION OF CONTRACT REQUIREMENTS.— 
In the case of a business associate of a covered entity that 
obtains or creates protected health information pursuant 
to a written contract (or other written arrangement) de-
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00083
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS
scribed in section 164.502(e)(2) of title 45, Code of Fed-
eral Regulations, with such covered entity, the business 
associate may use and disclose such protected health infor-
mation only if such use or disclosure, respectively, is in 
compliance with each applicable requirement of section 
164.504(e) of such title. 
(b) APPLICATION OF KNOWLEDGE ELEMENTS ASSO-
CIATED WITH CONTRACTS.—Section 164.504(e)(1)(ii) of 
title 45, Code of Federal Regulations, shall apply to a 
business associate described in subsection (a), with respect 
to compliance with such subsection, in the same manner 
that such section applies to a covered entity, with respect 
to compliance with the standards in sections 164.502(e) 
and 164.504(e) of such title, except that in applying such 
section 164.504(e)(1)(ii) each reference to the business as-
sociate, with respect to a contract, shall be treated as a 
reference to the covered entity involved in such contract. 
(c) APPLICATION
OF CIVIL
AND CRIMINAL PEN-
ALTIES.—In the case of a business associate that violates 
any provision of subsection (a) or (b), the provisions of 
sections 1176 and 1177 of the Social Security Act shall 
apply to the business associate with respect to such viola-
tion in the same manner as such provisions apply to a 
person who violates a provision of part C of title XI of 
such Act. 
VerDate Aug 31 2005 
00:58 Jun 26, 2008
Jkt 069200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6201
E:\BILLS\H6357.IH
H6357
jbell on PROD1PC69 with BILLS