292 
(c) ACCOUNTING OF CERTAIN PROTECTED HEALTH 
INFORMATION DISCLOSURES REQUIRED IF COVERED EN-
TITY USES ELECTRONIC HEALTH RECORD.— 
(1) IN GENERAL.—In applying section 164.528 
of title 45, Code of Federal Regulations, in the case 
that a covered entity uses or maintains an electronic 
health record with respect to protected health infor-
mation— 
(A) 
the 
exception 
under 
paragraph 
(a)(1)(i) of such section shall not apply to dis-
closures through an electronic health record 
made by such entity of such information; and 
(B) an individual shall have a right to re-
ceive an accounting of disclosures described in 
such paragraph of such information made by 
such covered entity during only the three years 
prior to the date on which the accounting is re-
quested. 
(2) REGULATIONS.—The Secretary shall pro-
mulgate regulations on what information shall be 
collected about each disclosure referred to in para-
graph (1)(A) not later than 18 months after the 
date on which the Secretary adopts standards on ac-
counting for disclosure described in the section 
3002(b)(2)(B)(iv) of the Public Health Service Act, 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00292
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
293 
as added by section 4101. Such regulations shall 
only require such information to be collected through 
an electronic health record in a manner that takes 
into account the interests of individuals in learning 
the circumstances under which their protected health 
information is being disclosed and takes into account 
the administrative burden of accounting for such 
disclosures. 
(3) CONSTRUCTION.—Nothing in this sub-
section shall be construed as requiring a covered en-
tity to account for disclosures of protected health in-
formation that are not made by such covered entity 
or by a business associate acting on behalf of the 
covered entity. 
(4) EFFECTIVE DATE.— 
(A) CURRENT
USERS
OF
ELECTRONIC 
RECORDS.—In the case of a covered entity inso-
far as it acquired an electronic health record as 
of January 1, 2009, paragraph (1) shall apply 
to disclosures, with respect to protected health 
information, made by the covered entity from 
such a record on and after January 1, 2014. 
(B) OTHERS.—In the case of a covered en-
tity insofar as it acquires an electronic health 
record after January 1, 2009, paragraph (1) 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00293
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
294 
shall apply to disclosures, with respect to pro-
tected health information, made by the covered 
entity from such record on and after the later 
of the following: 
(i) January 1, 2011; or 
(ii) the date that it acquires an elec-
tronic health record. 
(d) REVIEW OF HEALTH CARE OPERATIONS.—Not 
later than 18 months after the date of the enactment of 
this title, the Secretary shall promulgate regulations to 
eliminate from the definition of health care operations 
under section 164.501 of title 45, Code of Federal Regula-
tions, those activities that can reasonably and efficiently 
be conducted through the use of information that is de- 
identified (in accordance with the requirements of section 
164.514(b) of such title) or that should require a valid 
authorization for use or disclosure. In promulgating such 
regulations, the Secretary may choose to narrow or clarify 
activities that the Secretary chooses to retain in the defini-
tion of health care operations and the Secretary shall take 
into account the report under section 424(d). In such reg-
ulations the Secretary shall specify the date on which such 
regulations shall apply to disclosures made by a covered 
entity, but in no case would such date be sooner than the 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00294
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
295 
date that is 24 months after the date of the enactment 
of this section. 
(e) PROHIBITION ON SALE OF ELECTRONIC HEALTH 
RECORDS OR PROTECTED HEALTH INFORMATION OB-
TAINED FROM ELECTRONIC HEALTH RECORDS.— 
(1) IN GENERAL.—Except as provided in para-
graph (2), a covered entity or business associate 
shall not directly or indirectly receive remuneration 
in exchange for any protected health information of 
an individual unless the covered entity obtained from 
the individual, in accordance with section 164.508 of 
title 45, Code of Federal Regulations, a valid au-
thorization that includes, in accordance with such 
section, a specification of whether the protected 
health information can be further exchanged for re-
muneration by the entity receiving protected health 
information of that individual. 
(2) EXCEPTIONS.—Paragraph (1) shall not 
apply in the following cases: 
(A) The purpose of the exchange is for re-
search or public health activities (as described 
in sections 164.501, 164.512(i), and 164.512(b) 
of title 45, Code of Federal Regulations) and 
the price charged reflects the costs of prepara-
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00295
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
296 
tion and transmittal of the data for such pur-
pose. 
(B) The purpose of the exchange is for the 
treatment of the individual and the price 
charges reflects not more than the costs of 
preparation and transmittal of the data for 
such purpose. 
(C) The purpose of the exchange is the 
health care operation specifically described in 
subparagraph (iv) of paragraph (6) of the defi-
nition of health care operations in section 
164.501 of title 45, Code of Federal Regula-
tions. 
(D) The purpose of the exchange is for re-
muneration that is provided by a covered entity 
to a business associate for activities involving 
the exchange of protected health information 
that the business associate undertakes on behalf 
of and at the specific request of the covered en-
tity pursuant to a business associate agreement. 
(E) The purpose of the exchange is to pro-
vide an individual with a copy of the individ-
ual’s protected health information pursuant to 
section 164.524 of title 45, Code of Federal 
Regulations. 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00296
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
297 
(F) The purpose of the exchange is other-
wise determined by the Secretary in regulations 
to be similarly necessary and appropriate as the 
exceptions provided in subparagraphs (A) 
through (E). 
(3) REGULATIONS.—The Secretary shall pro-
mulgate regulations to carry out paragraph (this 
subsection, including exceptions described in para-
graph (2), not later than 18 months after the date 
of the enactment of this title. 
(4) EFFECTIVE
DATE.—Paragraph (1) shall 
apply to exchanges occurring on or after the date 
that is 6 months after the date of the promulgation 
of final regulations implementing this subsection. 
(f) ACCESS TO CERTAIN INFORMATION IN ELEC-
TRONIC FORMAT.—In applying section 164.524 of title 
45, Code of Federal Regulations, in the case that a cov-
ered entity uses or maintains an electronic health record 
with respect to protected health information of an indi-
vidual— 
(1) the individual shall have a right to obtain 
from such covered entity a copy of such information 
in an electronic format; and 
(2) notwithstanding paragraph (c)(4) of such 
section, any fee that the covered entity may impose 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00297
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
298 
for providing such individual with a copy of such in-
formation (or a summary or explanation of such in-
formation) if such copy (or summary or explanation) 
is in an electronic form shall not be greater than the 
entity’s labor costs in responding to the request for 
the copy (or summary or explanation). 
SEC. 4406. CONDITIONS ON CERTAIN CONTACTS AS PART 
OF HEALTH CARE OPERATIONS. 
(a) MARKETING.— 
(1) IN GENERAL.—A communication by a cov-
ered entity or business associate that is about a 
product or service and that encourages recipients of 
the communication to purchase or use the product 
or service shall not be considered a health care oper-
ation for purposes of subpart E of part 164 of title 
45, Code of Federal Regulations, unless the commu-
nication is made as described in subparagraph (i), 
(ii), or (iii) of paragraph (1) of the definition of 
marketing in section 164.501 of such title. 
(2) 
PAYMENT
FOR
CERTAIN
COMMUNICA-
TIONS.—A covered entity or business associate may 
not receive direct or indirect payment in exchange 
for making any communication described in sub-
paragraph (i), (ii), or (iii) of paragraph (1) of the 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00298
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
299 
definition of marketing in section 164.501 of title 
45, Code of Federal Regulations, except— 
(A) a business associate of a covered entity 
may receive payment from the covered entity 
for making any such communication on behalf 
of the covered entity that is consistent with the 
written contract (or other written arrangement) 
described in section 164.502(e)(2) of such title 
between such business associate and covered en-
tity; and 
(B) a covered entity may receive payment 
in exchange for making any such communica-
tion if the entity obtains from the recipient of 
the communication, in accordance with section 
164.508 of title 45, Code of Federal Regula-
tions, a valid authorization (as described in 
paragraph (b) of such section) with respect to 
such communication. 
(b) FUNDRAISING.—Fundraising for the benefit of a 
covered entity shall not be considered a health care oper-
ation for purposes of section 164.501 of title 45, Code of 
Federal Regulations. 
(c) EFFECTIVE DATE.—This section shall apply to 
contracting occurring on or after the effective date speci-
fied under section 4423. 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00299
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
300 
SEC. 4407. TEMPORARY BREACH NOTIFICATION REQUIRE-
MENT FOR VENDORS OF PERSONAL HEALTH 
RECORDS AND OTHER NON-HIPAA COVERED 
ENTITIES. 
(a) IN GENERAL.—In accordance with subsection (c), 
each vendor of personal health records, following the dis-
covery of a breach of security of unsecured PHR identifi-
able health information that is in a personal health record 
maintained or offered by such vendor, and each entity de-
scribed in clause (ii) or (iii) of section 4424(b)(1)(A), fol-
lowing the discovery of a breach of security of such infor-
mation that is obtained through a product or service pro-
vided by such entity, shall— 
(1) notify each individual who is a citizen or 
resident of the United States whose unsecured PHR 
identifiable health information was acquired by an 
unauthorized person as a result of such a breach of 
security; and 
(2) notify the Federal Trade Commission. 
(b) NOTIFICATION BY THIRD PARTY SERVICE PRO-
VIDERS.—A third party service provider that provides 
services to a vendor of personal health records or to an 
entity described in clause (ii) or (iii) of section 
4424(b)(1)(A) in connection with the offering or mainte-
nance of a personal health record or a related product or 
service and that accesses, maintains, retains, modifies, 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00300
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
301 
records, stores, destroys, or otherwise holds, uses, or dis-
closes unsecured PHR identifiable health information in 
such a record as a result of such services shall, following 
the discovery of a breach of security of such information, 
notify such vendor or entity, respectively, of such breach. 
Such notice shall include the identification of each indi-
vidual whose unsecured PHR identifiable health informa-
tion has been, or is reasonably believed to have been, 
accessed, acquired, or disclosed during such breach. 
(c) APPLICATION OF REQUIREMENTS FOR TIMELI-
NESS, METHOD, AND CONTENT
OF NOTIFICATIONS.— 
Subsections (c), (d), (e), and (f) of section 402 shall apply 
to a notification required under subsection (a) and a ven-
dor of personal health records, an entity described in sub-
section (a) and a third party service provider described 
in subsection (b), with respect to a breach of security 
under subsection (a) of unsecured PHR identifiable health 
information in such records maintained or offered by such 
vendor, in a manner specified by the Federal Trade Com-
mission. 
(d) NOTIFICATION OF THE SECRETARY.—Upon re-
ceipt of a notification of a breach of security under sub-
section (a)(2), the Federal Trade Commission shall notify 
the Secretary of such breach. 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00301
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
302 
(e) ENFORCEMENT.—A violation of subsection (a) or 
(b) shall be treated as an unfair and deceptive act or prac-
tice in violation of a regulation under section 18(a)(1)(B) 
of the Federal Trade Commission Act (15 U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or prac-
tices. 
(f) DEFINITIONS.—For purposes of this section: 
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’ means, with respect to unsecured PHR 
identifiable health information of an individual in a 
personal health record, acquisition of such informa-
tion without the authorization of the individual. 
(2) PHR IDENTIFIABLE
HEALTH
INFORMA-
TION.—The term ‘‘PHR identifiable health informa-
tion’’ means individually identifiable health informa-
tion, as defined in section 1171(6) of the Social Se-
curity Act (42 U.S.C. 1320d(6)), and includes, with 
respect to an individual, information— 
(A) that is provided by or on behalf of the 
individual; and 
(B) that identifies the individual or with 
respect to which there is a reasonable basis to 
believe that the information can be used to 
identify the individual. 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00302
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
303 
(3) UNSECURED
PHR
IDENTIFIABLE
HEALTH 
INFORMATION.— 
(A) IN
GENERAL.—Subject to subpara-
graph (B), the term ‘‘unsecured PHR identifi-
able health information’’ means PHR identifi-
able health information that is not protected 
through the use of a technology or methodology 
specified by the Secretary in the guidance 
issued under section 4402(h)(2). 
(B) EXCEPTION
IN
CASE
TIMELY
GUID-
ANCE NOT ISSUED.—In the case that the Sec-
retary does not issue guidance under section 
4402(h)(2) by the date specified in such sec-
tion, for purposes of this section, the term ‘‘un-
secured PHR identifiable health information’’ 
shall mean PHR identifiable health information 
that is not secured by a technology standard 
that renders protected health information unus-
able, unreadable, or indecipherable to unauthor-
ized individuals and that is developed or en-
dorsed by a standards developing organization 
that is accredited by the American National 
Standards Institute. 
(g) REGULATIONS; EFFECTIVE DATE; SUNSET.— 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00303
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
305 
SEC. 4408. BUSINESS ASSOCIATE CONTRACTS REQUIRED 
FOR CERTAIN ENTITIES. 
Each organization, with respect to a covered entity, 
that provides data transmission of protected health infor-
mation to such entity (or its business associate) and that 
requires access on a routine basis to such protected health 
information, such as a Health Information Exchange Or-
ganization, Regional Health Information Organization, E- 
prescribing Gateway, or each vendor that contracts with 
a covered entity to allow that covered entity to offer a per-
sonal health record to patients as part of its electronic 
health record, is required to enter into a written contract 
(or other written arrangement) described in section 
164.502(e)(2) of title 45, Code of Federal Regulations and 
a written contract (or other arrangement) described in 
section 164.308(b) of such title, with such entity and shall 
be treated as a business associate of the covered entity 
for purposes of the provisions of this subtitle and subparts 
C and E of part 164 of title 45, Code of Federal Regula-
tions, as such provisions are in effect as of the date of 
enactment of this title. 
SEC. 4409. CLARIFICATION OF APPLICATION OF WRONGFUL 
DISCLOSURES CRIMINAL PENALTIES. 
Section 1177(a) of the Social Security Act (42 U.S.C. 
1320d–6(a)) is amended by adding at the end the fol-
lowing new sentence: ‘‘For purposes of the previous sen-
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00305
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
306 
tence, a person (including an employee or other individual) 
shall be considered to have obtained or disclosed individ-
ually identifiable health information in violation of this 
part if the information is maintained by a covered entity 
(as defined in the HIPAA privacy regulation described in 
section 1180(b)(3)) and the individual obtained or dis-
closed such information without authorization.’’. 
SEC. 4410. IMPROVED ENFORCEMENT. 
(a) IN GENERAL.—Section 1176 of the Social Secu-
rity Act (42 U.S.C. 1320d–5) is amended— 
(1) in subsection (b)(1), by striking ‘‘the act 
constitutes an offense punishable under section 
1177’’ and inserting ‘‘a penalty has been imposed 
under section 1177 with respect to such act’’; and 
(2) by adding at the end the following new sub-
section: 
‘‘(c) NONCOMPLIANCE
DUE
TO
WILLFUL
NE-
GLECT.— 
‘‘(1) IN GENERAL.—A violation of a provision 
of this part due to willful neglect is a violation for 
which the Secretary is required to impose a penalty 
under subsection (a)(1). 
‘‘(2) REQUIRED INVESTIGATION.—For purposes 
of paragraph (1), the Secretary shall formally inves-
tigate any complaint of a violation of a provision of 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00306
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
307 
this part if a preliminary investigation of the facts 
of the complaint indicate such a possible violation 
due to willful neglect.’’. 
(b) EFFECTIVE DATE; REGULATIONS.— 
(1) The amendments made by subsection (a) 
shall apply to penalties imposed on or after the date 
that is 24 months after the date of the enactment 
of this title. 
(2) Not later than 18 months after the date of 
the enactment of this title, the Secretary of Health 
and Human Services shall promulgate regulations to 
implement such amendments. 
(c) DISTRIBUTION OF CERTAIN CIVIL MONETARY 
PENALTIES COLLECTED.— 
(1) IN
GENERAL.—Subject to the regulation 
promulgated pursuant to paragraph (3), any civil 
monetary penalty or monetary settlement collected 
with respect to an offense punishable under this sub-
title or section 1176 of the Social Security Act (42 
U.S.C. 1320d–5) insofar as such section relates to 
privacy or security shall be transferred to the Office 
of Civil Rights of the Department of Health and 
Human Services to be used for purposes of enforcing 
the provisions of this subtitle and subparts C and E 
of part 164 of title 45, Code of Federal Regulations, 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00307
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
308 
as such provisions are in effect as of the date of en-
actment of this Act. 
(2) GAO REPORT.—Not later than 18 months 
after the date of the enactment of this title, the 
Comptroller General shall submit to the Secretary a 
report including recommendations for a methodology 
under which an individual who is harmed by an act 
that constitutes an offense referred to in paragraph 
(1) may receive a percentage of any civil monetary 
penalty or monetary settlement collected with re-
spect to such offense. 
(3) ESTABLISHMENT
OF
METHODOLOGY
TO 
DISTRIBUTE PERCENTAGE OF CMPS COLLECTED TO 
HARMED
INDIVIDUALS.—Not later than 3 years 
after the date of the enactment of this title, the Sec-
retary shall establish by regulation and based on the 
recommendations submitted under paragraph (2), a 
methodology under which an individual who is 
harmed by an act that constitutes an offense re-
ferred to in paragraph (1) may receive a percentage 
of any civil monetary penalty or monetary settlement 
collected with respect to such offense. 
(4) APPLICATION
OF
METHODOLOGY.—The 
methodology under paragraph (3) shall be applied 
with respect to civil monetary penalties or monetary 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00308
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
309 
settlements imposed on or after the effective date of 
the regulation. 
(d) TIERED INCREASE IN AMOUNT OF CIVIL MONE-
TARY PENALTIES.— 
(1) IN GENERAL.—Section 1176(a)(1) of the 
Social Security Act (42 U.S.C. 1320d–5(a)(1)) is 
amended by striking ‘‘who violates a provision of 
this part a penalty of not more than’’ and all that 
follows and inserting the following: ‘‘who violates a 
provision of this part— 
‘‘(A) in the case of a violation of such pro-
vision in which it is established that the person 
did not know (and by exercising reasonable dili-
gence would not have known) that such person 
violated such provision, a penalty for each such 
violation of an amount that is at least the 
amount described in paragraph (3)(A) but not 
to exceed the amount described in paragraph 
(3)(D); 
‘‘(B) in the case of a violation of such pro-
vision in which it is established that the viola-
tion was due to reasonable cause and not to 
willful neglect, a penalty for each such violation 
of an amount that is at least the amount de-
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00309
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
310 
scribed in paragraph (3)(B) but not to exceed 
the amount described in paragraph (3)(D); and 
‘‘(C) in the case of a violation of such pro-
vision in which it is established that the viola-
tion was due to willful neglect— 
‘‘(i) if the violation is corrected as de-
scribed in subsection (b)(3)(A), a penalty 
in an amount that is at least the amount 
described in paragraph (3)(C) but not to 
exceed the amount described in paragraph 
(3)(D); and 
‘‘(ii) if the violation is not corrected 
as described in such subsection, a penalty 
in an amount that is at least the amount 
described in paragraph (3)(D). 
In determining the amount of a penalty under 
this section for a violation, the Secretary shall 
base such determination on the nature and ex-
tent of the violation and the nature and extent 
of the harm resulting from such violation.’’. 
(2) TIERS OF PENALTIES DESCRIBED.—Section 
1176(a) of such Act (42 U.S.C. 1320d–5(a)) is fur-
ther amended by adding at the end the following 
new paragraph: 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00310
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
311 
‘‘(3) TIERS
OF
PENALTIES
DESCRIBED.—For 
purposes of paragraph (1), with respect to a viola-
tion by a person of a provision of this part— 
‘‘(A) the amount described in this subpara-
graph is $100 for each such violation, except 
that the total amount imposed on the person 
for all such violations of an identical require-
ment or prohibition during a calendar year may 
not exceed $25,000; 
‘‘(B) the amount described in this subpara-
graph is $1,000 for each such violation, except 
that the total amount imposed on the person 
for all such violations of an identical require-
ment or prohibition during a calendar year may 
not exceed $100,000; 
‘‘(C) the amount described in this subpara-
graph is $10,000 for each such violation, except 
that the total amount imposed on the person 
for all such violations of an identical require-
ment or prohibition during a calendar year may 
not exceed $250,000; and 
‘‘(D) the amount described in this sub-
paragraph is $50,000 for each such violation, 
except that the total amount imposed on the 
person for all such violations of an identical re-
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00311
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
312 
quirement or prohibition during a calendar year 
may not exceed $1,500,000.’’. 
(3) 
CONFORMING
AMENDMENTS.—Section 
1176(b) of such Act (42 U.S.C. 1320d–5(b)) is 
amended— 
(A) by striking paragraph (2) and redesig-
nating paragraphs (3) and (4) as paragraphs 
(2) and (3), respectively; and 
(B) in paragraph (2), as so redesignated— 
(i) in subparagraph (A), by striking 
‘‘in subparagraph (B), a penalty may not 
be imposed under subsection (a) if’’ and all 
that follows through ‘‘the failure to comply 
is corrected’’ and inserting ‘‘in subpara-
graph (B) or subsection (a)(1)(C), a pen-
alty may not be imposed under subsection 
(a) if the failure to comply is corrected’’; 
and 
(ii) in subparagraph (B), by striking 
‘‘(A)(ii)’’ and inserting ‘‘(A)’’ each place it 
appears. 
(4) EFFECTIVE DATE.—The amendments made 
by this subsection shall apply to violations occurring 
after the date of the enactment of this title. 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00312
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
313 
(e) ENFORCEMENT THROUGH STATE ATTORNEYS 
GENERAL.— 
(1) IN GENERAL.—Section 1176 of the Social 
Security Act (42 U.S.C. 1320d–5) is amended by 
adding at the end the following new subsection: 
‘‘(c) ENFORCEMENT BY STATE ATTORNEYS GEN-
ERAL.— 
‘‘(1) CIVIL
ACTION.—Except as provided in 
subsection (b), in any case in which the attorney 
general of a State has reason to believe that an in-
terest of one or more of the residents of that State 
has been or is threatened or adversely affected by 
any person who violates a provision of this part, the 
attorney general of the State, as parens patriae, may 
bring a civil action on behalf of such residents of the 
State in a district court of the United States of ap-
propriate jurisdiction— 
‘‘(A) to enjoin further such violation by the 
defendant; or 
‘‘(B) to obtain damages on behalf of such 
residents of the State, in an amount equal to 
the amount determined under paragraph (2). 
‘‘(2) STATUTORY DAMAGES.— 
‘‘(A) IN GENERAL.—For purposes of para-
graph (1)(B), the amount determined under 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00313
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
314 
this paragraph is the amount calculated by mul-
tiplying the number of violations by up to $100. 
For purposes of the preceding sentence, in the 
case of a continuing violation, the number of 
violations shall be determined consistent with 
the HIPAA privacy regulations (as defined in 
section 1180(b)(3)) for violations of subsection 
(a). 
‘‘(B) LIMITATION.—The total amount of 
damages imposed on the person for all viola-
tions of an identical requirement or prohibition 
during a calendar year may not exceed $25,000. 
‘‘(C) REDUCTION
OF
DAMAGES.—In as-
sessing damages under subparagraph (A), the 
court may consider the factors the Secretary 
may consider in determining the amount of a 
civil money penalty under subsection (a) under 
the HIPAA privacy regulations. 
‘‘(3) ATTORNEY FEES.—In the case of any suc-
cessful action under paragraph (1), the court, in its 
discretion, may award the costs of the action and 
reasonable attorney fees to the State. 
‘‘(4) NOTICE TO SECRETARY.—The State shall 
serve prior written notice of any action under para-
graph (1) upon the Secretary and provide the Sec-
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00314
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
315 
retary with a copy of its complaint, except in any 
case in which such prior notice is not feasible, in 
which case the State shall serve such notice imme-
diately upon instituting such action. The Secretary 
shall have the right— 
‘‘(A) to intervene in the action; 
‘‘(B) upon so intervening, to be heard on 
all matters arising therein; and 
‘‘(C) to file petitions for appeal. 
‘‘(5) CONSTRUCTION.—For purposes of bring-
ing any civil action under paragraph (1), nothing in 
this section shall be construed to prevent an attor-
ney general of a State from exercising the powers 
conferred on the attorney general by the laws of that 
State. 
‘‘(6) VENUE; SERVICE OF PROCESS.— 
‘‘(A) VENUE.—Any action brought under 
paragraph (1) may be brought in the district 
court of the United States that meets applicable 
requirements relating to venue under section 
1391 of title 28, United States Code. 
‘‘(B) SERVICE OF PROCESS.—In an action 
brought under paragraph (1), process may be 
served in any district in which the defendant— 
‘‘(i) is an inhabitant; or 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00315
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
317 
(B) in paragraph (2)(A)— 
(i) in the matter before clause (i), by 
striking ‘‘a penalty may not be imposed 
under subsection (a)’’ and inserting ‘‘no 
penalty may be imposed under subsection 
(a) and no damages obtained under sub-
section (c)’’; and 
(ii) in clause (ii), by inserting ‘‘or 
damages’’ after ‘‘the penalty’’; 
(C) in paragraph (2)(B)(i), by striking 
‘‘The period’’ and inserting ‘‘With respect to 
the imposition of a penalty by the Secretary 
under subsection (a), the period’’; and 
(D) in paragraph (3), by inserting ‘‘and 
any damages under subsection (c)’’ after ‘‘any 
penalty under subsection (a)’’. 
(3) EFFECTIVE DATE.—The amendments made 
by this subsection shall apply to violations occurring 
after the date of the enactment of this Act. 
(f) ALLOWING CONTINUED USE OF CORRECTIVE AC-
TION.—Such section is further amended by adding at the 
end the following new subsection: 
‘‘(d) ALLOWING CONTINUED USE OF CORRECTIVE 
ACTION.—Nothing in this section shall be construed as 
preventing the Office of Civil Rights of the Department 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00317
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
318 
of Health and Human Services from continuing, in its dis-
cretion, to use corrective action without a penalty in cases 
where the person did not know (and by exercising reason-
able diligence would not have known) of the violation in-
volved.’’. 
SEC. 4411. AUDITS. 
The Secretary shall provide for periodic audits to en-
sure that covered entities and business associates that are 
subject to the requirements of this subtitle and subparts 
C and E of part 164 of title 45, Code of Federal Regula-
tions, as such provisions are in effect as of the date of 
enactment of this Act, comply with such requirements. 
PART II—RELATIONSHIP TO OTHER LAWS; REGU-
LATORY REFERENCES; EFFECTIVE DATE; RE-
PORTS 
SEC. 4421. RELATIONSHIP TO OTHER LAWS. 
(a) APPLICATION OF HIPAA STATE PREEMPTION.— 
Section 1178 of the Social Security Act (42 U.S.C. 
1320d–7) shall apply to a provision or requirement under 
this subtitle in the same manner that such section applies 
to a provision or requirement under part C of title XI of 
such Act or a standard or implementation specification 
adopted or established under sections 1172 through 1174 
of such Act. 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00318
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
319 
(b) HEALTH INSURANCE PORTABILITY
AND AC-
COUNTABILITY ACT.—The standards governing the pri-
vacy and security of individually identifiable health infor-
mation promulgated by the Secretary under sections 
262(a) and 264 of the Health Insurance Portability and 
Accountability Act of 1996 shall remain in effect to the 
extent that they are consistent with this subtitle. The Sec-
retary shall by rule amend such Federal regulations as re-
quired to make such regulations consistent with this sub-
title. 
SEC. 4422. REGULATORY REFERENCES. 
Each reference in this subtitle to a provision of the 
Code of Federal Regulations refers to such provision as 
in effect on the date of the enactment of this title (or to 
the most recent update of such provision). 
SEC. 4423. EFFECTIVE DATE. 
Except as otherwise specifically provided, the provi-
sions of part I shall take effect on the date that is 12 
months after the date of the enactment of this title. 
SEC. 4424. STUDIES, REPORTS, GUIDANCE. 
(a) REPORT ON COMPLIANCE.— 
(1) IN GENERAL.—For the first year beginning 
after the date of the enactment of this Act and an-
nually thereafter, the Secretary shall prepare and 
submit to the Committee on Health, Education, 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00319
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
320 
Labor, and Pensions of the Senate and the Com-
mittee on Ways and Means and the Committee on 
Energy and Commerce of the House of Representa-
tives a report concerning complaints of alleged viola-
tions of law, including the provisions of this subtitle 
as well as the provisions of subparts C and E of part 
164 of title 45, Code of Federal Regulations, (as 
such provisions are in effect as of the date of enact-
ment of this Act) relating to privacy and security of 
health information that are received by the Secretary 
during the year for which the report is being pre-
pared. Each such report shall include, with respect 
to such complaints received during the year— 
(A) the number of such complaints; 
(B) the number of such complaints re-
solved informally, a summary of the types of 
such complaints so resolved, and the number of 
covered entities that received technical assist-
ance from the Secretary during such year in 
order to achieve compliance with such provi-
sions and the types of such technical assistance 
provided; 
(C) the number of such complaints that 
have resulted in the imposition of civil monetary 
penalties or have been resolved through mone-
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00320
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
321 
tary settlements, including the nature of the 
complaints involved and the amount paid in 
each penalty or settlement; 
(D) the number of compliance reviews con-
ducted and the outcome of each such review; 
(E) the number of subpoenas or inquiries 
issued; 
(F) the Secretary’s plan for improving 
compliance with and enforcement of such provi-
sions for the following year; and 
(G) the number of audits performed and a 
summary of audit findings pursuant to section 
4411. 
(2) AVAILABILITY
TO
PUBLIC.—Each report 
under paragraph (1) shall be made available to the 
public on the Internet website of the Department of 
Health and Human Services. 
(b) STUDY AND REPORT ON APPLICATION OF PRI-
VACY AND SECURITY REQUIREMENTS TO NON-HIPAA 
COVERED ENTITIES.— 
(1) STUDY.—Not later than one year after the 
date of the enactment of this title, the Secretary, in 
consultation with the Federal Trade Commission, 
shall conduct a study, and submit a report under 
paragraph (2), on privacy and security requirements 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00321
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
322 
for entities that are not covered entities or business 
associates as of the date of the enactment of this 
title, including— 
(A) requirements relating to security, pri-
vacy, and notification in the case of a breach of 
security or privacy (including the applicability 
of an exemption to notification in the case of 
individually identifiable health information that 
has been rendered unusable, unreadable, or in-
decipherable through technologies or methodolo-
gies recognized by appropriate professional or-
ganization or standard setting bodies to provide 
effective security for the information) that 
should be applied to— 
(i) vendors of personal health records; 
(ii) entities that offer products or 
services through the website of a vendor of 
personal health records; 
(iii) entities that are not covered enti-
ties and that offer products or services 
through the s of covered entities that offer 
individuals personal health records; 
(iv) entities that are not covered enti-
ties and that access information in a per-
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00322
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
323 
sonal health record or send information to 
a personal health record; and 
(v) third party service providers used 
by a vendor or entity described in clause 
(i), (ii), (iii), or (iv) to assist in providing 
personal health record products or services; 
(B) a determination of which Federal Gov-
ernment agency is best equipped to enforce 
such requirements recommended to be applied 
to such vendors, entities, and service providers 
under subparagraph (A); and 
(C) a timeframe for implementing regula-
tions based on such findings. 
(2) REPORT.—The Secretary shall submit to 
the Committee on Finance, the Committee on 
Health, Education, Labor, and Pensions, and the 
Committee on Commerce of the Senate and the 
Committee on Ways and Means and the Committee 
on Energy and Commerce of the House of Rep-
resentatives a report on the findings of the study 
under paragraph (1) and shall include in such report 
recommendations on the privacy and security re-
quirements described in such paragraph. 
(c) GUIDANCE ON IMPLEMENTATION SPECIFICATION 
TO DE-IDENTIFY PROTECTED HEALTH INFORMATION.— 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00323
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
324 
Not later than 12 months after the date of the enactment 
of this title, the Secretary shall, in consultation with stake-
holders, issue guidance on how best to implement the re-
quirements for the de-identification of protected health in-
formation under section 164.514(b) of title 45, Code of 
Federal Regulations. 
(d) GAO REPORT ON TREATMENT DISCLOSURES.— 
Not later than one year after the date of the enactment 
of this title, the Comptroller General of the United States 
shall submit to the Committee on Health, Education, 
Labor, and Pensions of the Senate and the Committee on 
Ways and Means and the Committee on Energy and Com-
merce of the House of Representatives a report on the 
best practices related to the disclosure among health care 
providers of protected health information of an individual 
for purposes of treatment of such individual. Such report 
shall include an examination of the best practices imple-
mented by States and by other entities, such as health 
information exchanges and regional health information or-
ganizations, an examination of the extent to which such 
best practices are successful with respect to the quality 
of the resulting health care provided to the individual and 
with respect to the ability of the health care provider to 
manage such best practices, and an examination of the 
use of electronic informed consent for disclosing protected 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00324
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
325 
health information for treatment, payment, and health 
care operations. 
Subtitle E—Miscellaneous 
Medicare Provisions 
SEC. 4501. MORATORIA ON CERTAIN MEDICARE REGULA-
TIONS. 
(a) DELAY IN PHASE OUT OF MEDICARE HOSPICE 
BUDGET NEUTRALITY ADJUSTMENT FACTOR DURING 
FISCAL YEAR 2009.—Notwithstanding any other provi-
sion of law, including the final rule published on August 
8, 2008, 73 Federal Register 46464 et seq., relating to 
Medicare Program; Hospice Wage Index for Fiscal Year 
2009, the Secretary of Health and Human Services shall 
not phase out or eliminate the budget neutrality adjust-
ment factor in the Medicare hospice wage index before Oc-
tober 1, 2009, and the Secretary shall recompute and 
apply the final Medicare hospice wage index for fiscal year 
2009 as if there had been no reduction in the budget neu-
trality adjustment factor. 
(b) NON-APPLICATION OF PHASED-OUT INDIRECT 
MEDICAL EDUCATION (IME) ADJUSTMENT FACTOR FOR 
FISCAL YEAR 2009.— 
(1) IN GENERAL.—Section 412.322 of title 42, 
Code of Federal Regulations, shall be applied with-
out regard to paragraph (c) of such section, and the 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00325
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
326 
Secretary of Health and Human Services shall re-
compute payments for discharges occurring on or 
after October 1, 2008, as if such paragraph had 
never been in effect. 
(2) NO
EFFECT
ON
SUBSEQUENT
YEARS.— 
Nothing in paragraph (1) shall be construed as hav-
ing any effect on the application of paragraph (d) of 
section 412.322 of title 42, Code of Federal Regula-
tions. 
(c) FUNDING FOR IMPLEMENTATION.—In addition to 
funds otherwise available, for purposes of implementing 
the provisions of subsections (a) and (b), including costs 
incurred in reprocessing claims in carrying out such provi-
sions, the Secretary of Health and Human Services shall 
provide for the transfer from the Federal Hospital Insur-
ance Trust Fund established under section 1817 of the 
Social Security Act (42 U.S.C. 1395i) to the Centers for 
Medicare & Medicaid Services Program Management Ac-
count of $2,000,000 for fiscal year 2009. 
SEC. 4502. LONG-TERM CARE HOSPITAL TECHNICAL COR-
RECTIONS. 
(a) PAYMENT.—Subsection (c) of section 114 of the 
Medicare, Medicaid, and SCHIP Extension Act of 2007 
(Public Law 110–173) is amended— 
(1) in paragraph (1)— 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00326
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
327 
(A) by amending the heading to read as 
follows: ‘‘DELAY IN APPLICATION OF 25 PER-
CENT PATIENT THRESHOLD PAYMENT ADJUST-
MENT’’; 
(B) by striking ‘‘the date of the enactment 
of this Act’’ and inserting ‘‘July 1, 2007,’’; and 
(C) in subparagraph (A), by inserting ‘‘or 
to a long-term care hospital, or satellite facility, 
that as of December 29, 2007, was co-located 
with an entity that is a provider-based, off-cam-
pus location of a subsection (d) hospital which 
did not provide services payable under section 
1886(d) of the Social Security Act at the off- 
campus location’’ after ‘‘freestanding long-term 
care hospitals’’; and 
(2) in paragraph (2)— 
(A) in subparagraph (B)(ii), by inserting 
‘‘or that is described in section 412.22(h)(3)(i) 
of such title’’ before the period; and 
(B) in subparagraph (C), by striking ‘‘the 
date of the enactment of this Act’’ and insert-
ing ‘‘October 1, 2007 (or July 1, 2007, in the 
case of a satellite facility described in section 
412.22(h)(3)(i) of title 42, Code of Federal 
Regulations)’’. 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00327
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS