mission, and handling of electronic health infor-
mation transactions; 
(B) the ability of the bank to process 
transactions to which HIPAA regulations apply; 
(C) the backup and disaster recovery plans 
and capacity of the bank; 
(D) the privacy practices, procedures, and 
employee training programs of the bank con-
sistent with HIPAA regulations; and 
(E) the security practices, procedures, and 
employee training programs of the bank con-
sistent with HIPAA regulations, including com-
pliance with the HIPAA regulations security 
rule that protected health information must 
only be viewable by the intended recipient. 
(3) EXISTING
CLEARINGHOUSES.—An inde-
pendent health record bank operated by an entity 
that has been certified under part C of title XI of 
the Social Security Act (42 U.S.C. 1320d et seq.) as 
a health care clearinghouse before the date of the 
enactment of this Act shall be considered to be ac-
credited for purposes of paragraph (1). 
(c) INFORMATION REQUIREMENT.—An independent 
health record bank acting as a health care clearinghouse 
under this section shall ensure that reporting services are 
VerDate Aug 31 2005 
02:27 Jun 10, 2006
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H5559.IH
H5559
jcorcoran on PROD1PC62 with BILLS
provided to individual consumers in a manner that in-
cludes the provision of lists of individuals or organizations 
that have accessed the health record account of the con-
sumer or to whom health information disclosures con-
cerning the consumer have been made in accordance with 
the requirements of HIPAA regulations. 
SEC. 6. AVAILABILITY AND USE OF HEALTH INFORMATION 
IN BANK. 
(a) GENERAL RULE.—Except as provided in this sec-
tion, access to an individual’s electronic health record (or 
specified parts of such electronic health record) main-
tained by an independent health record bank shall only 
be provided with the prior authorization of the individual 
involved, as authenticated as provided for under the stand-
ards prescribed by the Board of Governors under section 
8. 
(b) AVAILABILITY OF DATA FOR RESEARCH AND 
OTHER ACTIVITIES.—An independent health record bank 
may sell nonidentifiable and partially identifiable health 
information, with respect to an individual, only if— 
(1) the bank and the individual agree to the 
sale; 
(2) the agreement provided for under para-
graph (1) includes parameters for the disclosure of 
information involved and a process for the authoriza-
VerDate Aug 31 2005 
02:27 Jun 10, 2006
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5559.IH
H5559
jcorcoran on PROD1PC62 with BILLS
tion of the further disclosure of partially identifiable 
health information; 
(3) the data involved are to be used for re-
search or other activities only as provided for in the 
agreement under paragraph (1); 
(4) the data involved do not identify the indi-
vidual who is the subject of the data; 
(5) the revenue to be derived from the sale of 
the data is collected by the bank and equally divided 
between the bank and the individual involved, except 
that revenue may also be distributed to health care 
providers and payers as incentives to contribute ad-
ditional data to the bank; and 
(6) the transaction otherwise meets the require-
ments and standards prescribed by the Board of 
Governors. 
(c) AVAILABILITY
OF
DATA
FOR
EMERGENCY 
HEALTH CARE.— 
(1) FINDINGS.—Congress finds that— 
(A) given the size and nature of visits to 
emergency departments in the United States, 
readily available health information could make 
the difference between life and death; and 
(B) because of the case mix and volume of 
patients treated in emergency departments, 
VerDate Aug 31 2005 
02:27 Jun 10, 2006
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5559.IH
H5559
jcorcoran on PROD1PC62 with BILLS
such departments are well positioned to provide 
information for public health surveillance, com-
munity risk assessment, research, education, 
training, quality improvement, and other uses. 
(2) USE
OF
DATA.—An independent health 
record bank may permit health care providers to ac-
cess, during an emergency department visit, a lim-
ited, authenticated information set concerning an in-
dividual for emergency response purposes without 
the prior consent of the individual. Such limited in-
formation may include— 
(A) patient identification information, as 
determined appropriate by the individual in-
volved; 
(B) provider identification that includes 
the use of unique provider identifiers as pro-
vided for in section 1173 of the Social Security 
Act (42 U.S.C. 1320d–2); 
(C) payment information; 
(D) arrival and first assessment data; 
(E) information related to existing chronic 
problems and active clinical conditions of the 
individual; 
(F) information related to the individual’s 
vitals, allergies, and medication history; and 
VerDate Aug 31 2005 
02:27 Jun 10, 2006
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5559.IH
H5559
jcorcoran on PROD1PC62 with BILLS
(G) information concerning physical exami-
nations, procedures, results, and diagnosis in-
formation relating to the visit. 
SEC. 7. ENSURING PRIVACY AND SECURITY. 
(a) IN GENERAL.—Current Federal security and con-
fidentiality standards and State security amd confiden-
tiality laws shall apply to this Act (and the amendments 
made by this Act) until such time as Congress acts to 
amend such standards. 
(b) APPLICATION
OF HIPAA REGULATIONS
AND 
TRANSACTIONAL STANDARDS.—Nothing in this Act (or 
the amendments made by this Act) shall be construed to 
narrow the scope, substance, or applicability of part C of 
title XI of the Social Security Act (42 U.S.C. 1320d et 
seq.), or HIPAA regulations, as such provisions or regula-
tions relate to individually identifiable health information 
maintained in an independent health record bank. 
(c) TREATMENT OF STATE LAWS.—Nothing in this 
Act (or the amendments made by this Act) shall be con-
strued as preempting or otherwise affecting any provision 
of State law (or any State regulation) relating to the pri-
vacy and confidentiality of individually identifiable health 
information or to the security of such information, to the 
extent that such provision (or regulation)— 
VerDate Aug 31 2005 
02:27 Jun 10, 2006
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5559.IH
H5559
jcorcoran on PROD1PC62 with BILLS