I 
110TH CONGRESS 
1ST SESSION H. R. 2991 
To improve the availability of health information and the provision of health 
care by encouraging the creation, use, and maintenance of lifetime elec-
tronic health records of individuals in independent health record trusts 
and by providing a secure and privacy-protected framework in which 
such records are made available only by the affirmative consent of such 
individuals and are used to build a nationwide health information tech-
nology infrastructure. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 11, 2007 
Mr. MOORE of Kansas (for himself, Mr. RYAN of Wisconsin, Mr. BARROW, 
Mrs. BLACKBURN, Mr. BOUSTANY, Mr. BOYD of Florida, Mrs. BOYDA of 
Kansas, Mr. CLAY, Mr. CLEAVER, Mr. COOPER, Mr. CROWLEY, Mr. 
DAVIS of Alabama, Mr. LINCOLN DAVIS of Tennessee, Mr. DELAHUNT, 
Mr. DICKS, Mrs. EMERSON, Mr. ETHERIDGE, Mr. GRAVES, Mr. HELLER 
of Nevada, Mr. HERGER, Mr. HILL, Mr. HOLDEN, Mr. HOLT, Mrs. 
JONES of Ohio, Mr. LARSON of Connecticut, Mrs. MCCARTHY of New 
York, Mr. MITCHELL, Mr. MORAN of Kansas, Mr. PUTNAM, Mrs. 
MCMORRIS RODGERS, Mr. SENSENBRENNER, Mr. SESSIONS, Mr. SMITH 
of Washington, Mrs. TAUSCHER, Mr. TIAHRT, and Mr. BAIRD) intro-
duced the following bill; which was referred to the Committee on Energy 
and Commerce, and in addition to the Committee on Ways and Means, 
for a period to be subsequently determined by the Speaker, in each case 
for consideration of such provisions as fall within the jurisdiction of the 
committee concerned 
A BILL 
To improve the availability of health information and the 
provision of health care by encouraging the creation, 
use, and maintenance of lifetime electronic health records 
of individuals in independent health record trusts and 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
by providing a secure and privacy-protected framework 
in which such records are made available only by the 
affirmative consent of such individuals and are used to 
build a nationwide health information technology infra-
structure. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Independent Health Record Trust Act of 2007’’. 
(b) TABLE OF CONTENTS.—The table of contents of 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Purpose. 
Sec. 3. Definitions. 
Sec. 4. Establishment, certification, and membership of independent health 
record trusts. 
Sec. 5. Duties of IHRT to IHRT participants. 
Sec. 6. Availability and use of information from records in IHRT consistent 
with privacy protections and agreements. 
Sec. 7. Voluntary nature of trust participation and information sharing. 
Sec. 8. Financing of activities. 
Sec. 9. Regulatory oversight. 
SEC. 2. PURPOSE. 
It is the purpose of this Act to provide for the estab-
lishment of a nationwide health information technology 
network that— 
(1) improves health care quality, reduces med-
ical errors, increases the efficiency of care, and ad-
vances the delivery of appropriate, evidence-based 
health care services; 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
(2) promotes wellness, disease prevention, and 
the management of chronic illnesses by increasing 
the availability and transparency of information re-
lated to the health care needs of an individual; 
(3) ensures that appropriate information nec-
essary to make medical decisions is available in a us-
able form at the time and in the location that the 
medical service involved is provided; 
(4) produces greater value for health care ex-
penditures by reducing health care costs that result 
from inefficiency, medical errors, inappropriate care, 
and incomplete information; 
(5) promotes a more effective marketplace, 
greater competition, greater systems analysis, in-
creased choice, enhanced quality, and improved out-
comes in health care services; 
(6) improves the coordination of information 
and the provision of such services through an effec-
tive infrastructure for the secure and authorized ex-
change and use of health information; and 
(7) ensures that the health information privacy, 
security, and confidentiality of individually identifi-
able health information is protected. 
SEC. 3. DEFINITIONS. 
In this Act: 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
(1) ACCESS.—The term ‘‘access’’ means, with 
respect to an electronic health record, entering infor-
mation into such account as well as retrieving infor-
mation from such account. 
(2) ACCOUNT.—The term ‘‘account’’ means an 
electronic health record of an individual contained in 
an independent health record trust. 
(3) AFFIRMATIVE
CONSENT.—The term ‘‘af-
firmative consent’’ means, with respect to an elec-
tronic health record of an individual contained in an 
IHRT, express consent given by the individual for 
the use of such record in response to a clear and 
conspicuous request for such consent or at the indi-
vidual’s own initiative. 
(4) AUTHORIZED EHR DATA USER.—The term 
‘‘authorized EHR data user’’ means, with respect to 
an electronic health record of an IHRT participant 
contained as part of an IHRT, any entity (other 
than the participant) authorized (in the form of af-
firmative consent) by the participant to access the 
electronic health record. 
(5) CONFIDENTIALITY.—The term ‘‘confiden-
tiality’’ means, with respect to individually identifi-
able health information of an individual, the obliga-
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
tion of those who receive such information to respect 
the health information privacy of the individual. 
(6) ELECTRONIC HEALTH RECORD.—The term 
‘‘electronic health record’’ means a longitudinal col-
lection of information concerning a single individual, 
including medical records and personal health infor-
mation, that is stored electronically. 
(7) HEALTH
INFORMATION
PRIVACY.—The 
term ‘‘health information privacy’’ means, with re-
spect to individually identifiable health information 
of an individual, the right of such individual to con-
trol the acquisition, uses, or disclosures of such in-
formation. 
(8) HEALTH PLAN.—The term ‘‘health plan’’ 
means a group health plan (as defined in section 
2208(1) of the Public Health Service Act (42 U.S.C. 
300bb–8(1))) as well as a plan that offers health in-
surance coverage in the individual market. 
(9) HIPAA PRIVACY REGULATIONS.—The term 
‘‘HIPAA privacy regulations’’ means the regulations 
promulgated under section 264(c) of the Health In-
surance Portability and Accountability Act of 1996 
(42 U.S.C. 1320d–2 note). 
(10) INDEPENDENT HEALTH RECORD TRUST; 
IHRT.—The terms ‘‘independent health record trust’’ 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
and ‘‘IHRT’’ mean a legal arrangement under the 
administration of an IHRT operator that meets the 
requirements of this Act with respect to electronic 
health records of individuals participating in the 
trust or IHRT. 
(11) IHRT OPERATOR.—The term ‘‘IHRT op-
erator’’ means, with respect to an IHRT, the organi-
zation that is responsible for the administration and 
operation of the IHRT in accordance with this Act. 
(12) IHRT PARTICIPANT.—The term ‘‘IHRT 
participant’’ means, with respect to an IHRT, an in-
dividual who has a participation agreement in effect 
with respect to the maintenance of the individual’s 
electronic health record by the IHRT. 
(13) INDIVIDUALLY IDENTIFIABLE HEALTH IN-
FORMATION.—The term ‘‘individually identifiable 
health information’’ has the meaning given such 
term in section 1171(6) of the Social Security Act 
(42 U.S.C. 1320d(6)). 
(14) SECURITY.—The term ‘‘security’’ means, 
with respect to individually identifiable health infor-
mation of an individual, the physical, technological, 
or administrative safeguards or tools used to protect 
such information from unwarranted access or disclo-
sure. 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
SEC. 4. ESTABLISHMENT, CERTIFICATION, AND MEMBER-
SHIP OF INDEPENDENT HEALTH RECORD 
TRUSTS. 
(a) ESTABLISHMENT.—Not later than one year after 
the date of the enactment of this Act, the Federal Trade 
Commission, in consultation with the National Committee 
on Vital and Health Statistics, shall prescribe standards 
for the establishment, certification, operation, and inter-
operability of IHRTs to carry out the purposes described 
in section 2 in accordance with the provisions of this Act. 
(b) CERTIFICATION.— 
(1) CERTIFICATION
BY
FTC.—The Federal 
Trade Commission shall provide for the certification 
of IHRTs. No IHRT may be certified unless the 
IHRT is determined to meet the standards for cer-
tification established under subsection (a). 
(2) DECERTIFICATION.—The Federal Trade 
Commission shall establish a process for the revoca-
tion of certification of an IHRT under this section 
in the case that the IHRT violates the standards es-
tablished under subsection (a). 
(c) MEMBERSHIP.— 
(1) IN GENERAL.—To be eligible to be a partic-
ipant in an IHRT, an individual shall— 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
(A) submit to the IHRT information as re-
quired by the IHRT to establish an electronic 
health record with the IHRT; and 
(B) enter into a privacy protection agree-
ment described in section 6(b)(1) with the 
IHRT. 
The process to determine eligibility of an individual 
under this subsection shall allow for the establish-
ment by such individual of an electronic health 
record as expeditiously as possible if such individual 
is determined so eligible. 
(2) NO LIMITATION ON MEMBERSHIP.—Nothing 
in this subsection shall be construed to permit an 
IHRT to restrict membership, including on the basis 
of health condition. 
SEC. 5. DUTIES OF IHRT TO IHRT PARTICIPANTS. 
(a) FIDUCIARY DUTY OF IHRT; PENALTIES FOR 
VIOLATIONS OF FIDUCIARY DUTY.— 
(1) FIDUCIARY
DUTY.—With respect to the 
electronic health record of an IHRT participant 
maintained by an IHRT, the IHRT shall have a fi-
duciary duty to act for the benefit and in the inter-
ests of such participant and of the IHRT as a whole. 
Such duty shall include obtaining the affirmative 
consent of such participant prior to the release of in-
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
formation in such participant’s electronic health 
record in accordance with the requirements of this 
Act. 
(2) PENALTIES.—If the IHRT knowingly or 
recklessly breaches the fiduciary duty described in 
paragraph (1), the IHRT shall be subject to the fol-
lowing penalties: 
(A) Loss of certification of the IHRT. 
(B) A fine that is not in excess of $50,000. 
(C) A term of imprisonment for the indi-
viduals involved of not more than 5 years. 
(b) ELECTRONIC HEALTH RECORD DEEMED TO BE 
HELD IN TRUST BY IHRT.—With respect to an indi-
vidual, an electronic health record maintained by an IHRT 
shall be deemed to be held in trust by the IHRT for the 
benefit of the individual and the IHRT shall have no legal 
or equitable interest in such electronic health record. 
SEC. 6. AVAILABILITY AND USE OF INFORMATION FROM 
RECORDS IN IHRT CONSISTENT WITH PRI-
VACY PROTECTIONS AND AGREEMENTS. 
(a) PROTECTED ELECTRONIC HEALTH RECORDS 
USE AND ACCESS.— 
(1) GENERAL RIGHTS REGARDING USES OF IN-
FORMATION.— 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
(A) IN
GENERAL.—With respect to the 
electronic health record of an IHRT participant 
maintained by an IHRT, subject to paragraph 
(2)(C), primary uses and secondary uses (de-
scribed in subparagraphs (B) and (C), respec-
tively) of information within such record (other 
than by such participant) shall be permitted 
only upon the authorization of such use, prior 
to such use, by such participant. 
(B) PRIMARY USES.—For purposes of sub-
paragraph (A) and with respect to an electronic 
health record of an individual, a primary use is 
a use for purposes of the individual’s self-care 
or care by health care professionals. 
(C) SECONDARY USES.—For purposes of 
subparagraph (B) and with respect to an elec-
tronic health record of an individual, a sec-
ondary use is any use not described in subpara-
graph (B) and includes a use for purposes of 
public health research or other related activi-
ties. Additional authorization is required for a 
secondary use extending beyond the original 
purpose of the secondary use authorized by the 
IHRT participant involved. Nothing in this 
paragraph shall be construed as requiring au-
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
thorization for every secondary use that is with-
in the authorized original purpose. 
(2) RULES FOR PRIMARY USE OF RECORDS FOR 
HEALTH CARE PURPOSES.—With respect to the elec-
tronic health record of an IHRT participant (or 
specified parts of such electronic health record) 
maintained by an IHRT standards for access to 
such record shall provide for the following: 
(A) ACCESS
BY
IHRT
PARTICIPANTS
TO 
THEIR ELECTRONIC HEALTH RECORDS.— 
(i) 
OWNERSHIP.—The 
participant 
maintains ownership over the entire elec-
tronic health record (and all portions of 
such record) and shall have the right to 
electronically access and review the con-
tents of the entire record (and any portion 
of such record) at any time, in accordance 
with this subparagraph. 
(ii) ADDITION OF PERSONAL INFOR-
MATION.—The participant may add per-
sonal health information to the health 
record of that participant, except that such 
participant shall not alter information that 
is entered into the electronic health record 
by any authorized EHR data user. Such 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
participant shall have the right to propose 
an amendment to information that is en-
tered by an authorized EHR data user 
pursuant to standards prescribed by the 
Federal Trade Commission for purposes of 
amending such information. 
(iii) IDENTIFICATION
OF
INFORMA-
TION ENTERED BY PARTICIPANT.—Any ad-
ditions or amendments made by the partic-
ipant to the health record shall be identi-
fied and disclosed within such record as 
being made by such participant. 
(B) ACCESS
BY
ENTITIES
OTHER
THAN 
IHRT PARTICIPANT.— 
(i) AUTHORIZED ACCESS ONLY.—Ex-
cept as provided under subparagraph (C) 
and paragraph (4), access to the electronic 
health record (or any portion of the 
record)— 
(I) may be made only by author-
ized EHR data users and only to such 
portions of the record as specified by 
the participant; and 
(II) may be limited by the partic-
ipant for purposes of entering infor-
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
mation into such record, retrieving in-
formation from such record, or both. 
(ii) IDENTIFICATION OF ENTITY THAT 
ENTERS
INFORMATION.—Any information 
that is added by an authorized EHR data 
user to the health record shall be identified 
and disclosed within such record as being 
made by such user. 
(iii) SATISFACTION OF HIPAA PRIVACY 
REGULATIONS.—In the case of a record of 
a covered entity (as defined for purposes of 
HIPAA privacy regulations), with respect 
to an individual, if such individual is an 
IHRT participant with an independent 
health record trust and such covered entity 
is an authorized EHR data user, the re-
quirement under the HIPAA privacy regu-
lations for such entity to provide the 
record to the participant shall be deemed 
met if such entity, without charge to the 
IHRT or the participant— 
(I) forwards to the trust an ap-
propriately formatted electronic copy 
of the record (and updates to such 
records) for inclusion in the electronic 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
health record of the participant main-
tained by the trust; 
(II) enters such record into the 
electronic health record of the partici-
pant so maintained; or 
(III) 
otherwise 
makes 
such 
record available for electronic access 
by the IHRT or the individual in a 
manner that permits such record to 
be included in the account of the indi-
vidual contained in the IHRT. 
(iv) NOTIFICATION OF SENSITIVE IN-
FORMATION.—Any information, with re-
spect to the participant, that is sensitive 
information, as specified by the Federal 
Trade Commission, shall not be forwarded 
or entered by an authorized EHR data 
user into the electronic health record of the 
participant maintained by the trust unless 
the user certifies that the participant has 
been notified of such information. 
(C) DEEMED AUTHORIZATION FOR ACCESS 
FOR EMERGENCY HEALTH CARE.— 
(i) FINDINGS.—Congress finds that— 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
(I) given the size and nature of 
visits to emergency departments in 
the United States, readily available 
health information could make the dif-
ference between life and death; and 
(II) because of the case mix and 
volume of patients treated, emergency 
departments are well positioned to 
provide information for public health 
surveillance, community risk assess-
ment, research, education, training, 
quality improvement, and other uses. 
(ii) USE OF INFORMATION.—With re-
spect to the electronic health record of an 
IHRT participant (or specified parts of 
such electronic health record) maintained 
by an IHRT, the participant shall be 
deemed as providing authorization (in the 
form of affirmative consent) for health 
care providers to access, in connection with 
providing emergency care services to the 
participant, a limited, authenticated infor-
mation set concerning the participant for 
emergency response purposes, unless the 
participant specifies that such information 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
set (or any portion of such information 
set) may not be so accessed. Such limited 
information set may include information— 
(I) patient identification data, as 
determined appropriate by the partici-
pant; 
(II) provider identification that 
includes the use of unique provider 
identifiers; 
(III) payment information; 
(IV) information related to the 
individual’s vitals, allergies, and medi-
cation history; 
(V) information related to exist-
ing chronic problems and active clin-
ical conditions of the participant; and 
(VI) 
information 
concerning 
physical examinations, procedures, re-
sults, and diagnosis data. 
(3) RULES FOR SECONDARY USES OF RECORDS 
FOR RESEARCH AND OTHER PURPOSES.— 
(A) IN
GENERAL.—With respect to the 
electronic health record of an IHRT participant 
(or specified parts of such electronic health 
record) maintained by an IHRT, the IHRT 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
may sell such record (or specified parts of such 
record) only if— 
(i) the transfer is authorized by the 
participant pursuant to an agreement be-
tween the participant and the IHRT and is 
in accordance with the privacy protection 
agreement described in subsection (b)(1) 
entered into between such participant and 
such IHRT; 
(ii) such agreement includes param-
eters with respect to the disclosure of in-
formation involved and a process for the 
authorization of the further disclosure of 
information in such record; 
(iii) the information involved is to be 
used for research or other activities only as 
provided for in the agreement; 
(iv) the recipient of the information 
provides assurances that the information 
will not be further transferred or reused in 
violation of such agreement; and 
(v) the transfer otherwise meets the 
requirements and standards prescribed by 
the Federal Trade Commission. 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
(B) TREATMENT OF PUBLIC HEALTH RE-
PORTING.—Nothing in this paragraph shall be 
construed as prohibiting or limiting the use of 
health care information of an individual, includ-
ing an individual who is an IHRT participant, 
for public health reporting (or other research) 
purposes prior to the inclusion of such informa-
tion in an electronic health record maintained 
by an IHRT. 
(4) LAW
ENFORCEMENT
CLARIFICATION.— 
Nothing in this Act shall prevent an IHRT from dis-
closing information contained in an electronic health 
record maintained by the IHRT when required for 
purposes of a lawful investigation or official pro-
ceeding inquiring into a violation of, or failure to 
comply with, any criminal or civil statute or any reg-
ulation, rule, or order issued pursuant to such a 
statute. 
(5) RULE OF CONSTRUCTION.—Nothing in this 
section shall be construed to require a health care 
provider that does not utilize electronic methods or 
appropriate levels of health information technology 
on the date of the enactment of this Act to adopt 
such electronic methods or technology as a require-
ment for participation or compliance under this Act. 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
(b) PRIVACY PROTECTION AGREEMENT; TREATMENT 
OF STATE PRIVACY AND SECURITY LAWS.— 
(1) PRIVACY PROTECTION AGREEMENT.—A pri-
vacy protection agreement described in this sub-
section is an agreement, with respect to an electronic 
health record of an IHRT participant to be main-
tained by an independent health record trust, be-
tween the participant and the trust— 
(A) that is consistent with the standards 
described in subsection (a)(2); 
(B) under which the participant specifies 
the portions of the record that may be accessed, 
under what circumstances such portions may be 
accessed, any authorizations for indicated au-
thorized EHR data users to access information 
contained in the record, and the purposes for 
which the information (or portions of the infor-
mation) in the record may be used; 
(C) which provides a process for the au-
thorization of the transfer of information con-
tained in the record to a third party, including 
for the sale of such information for purposes of 
research, by an authorized EHR data user and 
reuse of such information by such third party, 
including a provision requiring that such trans-
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
fer and reuse is not in violation of any privacy 
or transfer restrictions placed by the partici-
pant on the independent health record of such 
participant; and 
(D) under which the trust provides assur-
ances that the trust will not transfer, disclose, 
or provide access to the record (or any portion 
of the record) in violation of the parameters es-
tablished in the agreement or to any person or 
entity who has not agreed to use and transfer 
such record (or portion of such record) in ac-
cordance with such agreement. 
(2) TREATMENT OF STATE LAWS.— 
(A) IN
GENERAL.—Except as provided 
under subparagraph (B), the provisions of a 
privacy protection agreement entered into be-
tween an IHRT and an IHRT participant shall 
preempt any provision of State law (or any 
State regulation) relating to the privacy and 
confidentiality of individually identifiable health 
information or to the security of such health in-
formation. 
(B) EXCEPTION FOR PRIVILEGED INFOR-
MATION.—The provisions of a privacy protec-
tion agreement shall not preempt any provision 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
of State law (or any State regulation) that rec-
ognizes privileged communications between phy-
sicians, health care practitioners, and patients 
of such physicians or health care practitioners, 
respectively. 
(C) STATE
DEFINED.—For purposes of 
this section, the term ‘‘State’’ has the meaning 
given such term when used in title XI of the 
Social Security Act, as provided under section 
1101(a) of such Act (42 U.S.C. 1301(a)). 
SEC. 7. VOLUNTARY NATURE OF TRUST PARTICIPATION 
AND INFORMATION SHARING. 
(a) IN GENERAL.—Participation in an independent 
health record trust, or authorizing access to information 
from such a trust, is voluntary. No employer, health insur-
ance issuer, group health plan, health care provider, or 
other person may require, as a condition of employment, 
issuance of a health insurance policy, coverage under a 
group health plan, the provision of health care services, 
payment for such services, or otherwise, that an individual 
participate in, or authorize access to information from, an 
independent health record trust. 
(b) ENFORCEMENT.—The penalties provided for in 
subsection (a) of section 1177 of the Social Security Act 
(42 U.S.C. 1320d–6) shall apply to a violation of sub-
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
section (a) in the same manner as such penalties apply 
to a person in violation of subsection (a) of such section. 
SEC. 8. FINANCING OF ACTIVITIES. 
(a) IN GENERAL.—Except as provided in subsection 
(b), an IHRT may generate revenue to pay for the oper-
ations of the IHRT through— 
(1) charging IHRT participants account fees 
for use of the trust; 
(2) charging authorized EHR data users for ac-
cessing electronic health records maintained in the 
trust; 
(3) the sale of information contained in the 
trust (as provided for in section 6(a)(3)(A)); and 
(4) any other activity determined appropriate 
by the Federal Trade Commission. 
(b) PROHIBITION
AGAINST
ACCESS
FEES
FOR 
HEALTH CARE PROVIDERS.—For purposes of providing 
incentives to health care providers to access information 
maintained in an IHRT, as authorized by the IHRT par-
ticipants involved, the IHRT may not charge a fee for 
services specified by the IHRT. Such services shall include 
the transmittal of information from a health care provider 
to be included in an independent electronic health record 
maintained by the IHRT (or permitting such provider to 
input such information into the record), including the 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
transmission of or access to information described in sec-
tion 6(a)(2)(C)(ii) by appropriate emergency responders. 
(c) REQUIRED
DISCLOSURES.—The sources and 
amounts of revenue derived under subsection (a) for the 
operations of an IHRT shall be fully disclosed to each 
IHRT participant of such IHRT and to the public. 
(d) TREATMENT OF INCOME.—For purposes of the 
Internal Revenue Code of 1986, any revenue described in 
subsection (a) shall not be included in gross income of any 
IHRT, IHRT participant, or authorized EHR data user. 
SEC. 9. REGULATORY OVERSIGHT. 
(a) IN GENERAL.—In carrying out this Act, the Fed-
eral Trade Commission shall promulgate regulations for 
independent health record trusts. 
(b) ESTABLISHMENT
OF INTERAGENCY STEERING 
COMMITTEE.— 
(1) IN GENERAL.—The Secretary of Health and 
Human Services shall establish an Interagency 
Steering Committee in accordance with this sub-
section. 
(2) CHAIRPERSON.—The Secretary of Health 
and Human Services shall serve as the chairperson 
of the Interagency Steering Committee. 
(3) MEMBERSHIP.—The members of the Inter-
agency Steering Committee shall consist of the At-
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
torney General, the Chairperson of the Federal 
Trade Commission, the Chairperson for the National 
Committee for Vital and Health Statistics, a rep-
resentative of the Federal Reserve, and other Fed-
eral officials determined appropriate by the Sec-
retary of Health and Human Services. 
(4) DUTIES.—The Interagency Steering Com-
mittee shall coordinate the implementation of this 
Act, including the implementation of policies de-
scribed in subsection (d) based upon the rec-
ommendations provided under such subsection, and 
regulations promulgated under this Act. 
(c) FEDERAL ADVISORY COMMITTEE.— 
(1) IN GENERAL.—The National Committee for 
Vital and Health Statistics shall serve as an advisory 
committee for the IHRTs. The membership of such 
advisory committee shall include a representative 
from the Federal Trade Commission and the chair-
person of the Interagency Steering Committee. Not 
less than 60 percent of such membership shall con-
sist of representatives of nongovernment entities, at 
least one of whom shall be a representative from an 
organization representing health care consumers. 
(2) DUTIES.—The National Committee for 
Vital and Health Statistics shall issue periodic re-
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
ports and review policies concerning IHRTs based 
on each of the following factors: 
(A) Privacy and security policies. 
(B) Economic progress. 
(C) Interoperability standards. 
(d) POLICIES RECOMMENDED BY FEDERAL TRADE 
COMMISSION.—The Federal Trade Commission, in con-
sultation with the National Committee for Vital and 
Health Statistics, shall recommend policies to— 
(1) provide assistance to encourage the growth 
of independent health record trusts; 
(2) track economic progress as it pertains to 
operators of independent health records trusts and 
individuals receiving nontaxable income with respect 
to accounts; 
(3) conduct public education activities regarding 
the creation and usage of the independent health 
records trusts; 
(4) establish standards for the interoperability 
of health information technology to ensure that in-
formation contained in such record may be shared 
between the trust involved, the participant, and au-
thorized EHR data users, including for the stand-
ardized collection and transmission of individual 
health records (or portions of such records) to au-
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
thorized EHR data users through a common inter-
face and for the portability of such records among 
independent health record trusts; and 
(5) carry out any other activities determined 
appropriate by the Federal Trade Commission. 
(e) REGULATIONS
PROMULGATED
BY
FEDERAL 
TRADE COMMISSION.—The Federal Trade Commission 
shall promulgate regulations based on, at a minimum, the 
following factors: 
(1) Requiring that an IHRT participant, who 
has an electronic health record that is maintained by 
an IHRT, be notified of a security breech with re-
spect to such record, and any corrective action taken 
on behalf of the participant. 
(2) Requiring that information sent to, or re-
ceived from, an IHRT that has been designated as 
high-risk should be authenticated through the use of 
methods such as the periodic changing of passwords, 
the use of biometrics, the use of tokens or other 
technology as determined appropriate by the council. 
(3) Requiring a delay in releasing sensitive 
health care test results and other similar informa-
tion to patients directly in order to give physicians 
time to contact the patient. 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
(4) Recommendations for entities operating 
IHRTs, including requiring analysis of the potential 
risk of health transaction security breeches based on 
set criteria. 
(5) The conduct of audits of IHRTs to ensure 
that they are in compliance with the requirements 
and standards established under this Act. 
(6) Disclosure to IHRT participants of the 
means by which such trusts are financed, including 
revenue from the sale of patient data. 
(7) Prevention of certification of an entity seek-
ing independent heath record trust certification 
based on— 
(A) the potential for conflicts between the 
interests of such entity and the security of the 
health information involved; and 
(B) the involvement of the entity in any 
activity that is contrary to the best interests of 
a patient. 
(8) Prevention of the use of revenue sources 
that are contrary to a patient’s interests. 
(9) Public disclosure of audits in a manner 
similar to financial audits required for publicly trad-
ed stock companies. 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
(10) Requiring notification to a participating 
entity that the information contained in such record 
may not be representative of the complete or accu-
rate electronic health record of such account holder. 
(f) COMPLIANCE REPORT.—Not later than 1 year 
after the date of the enactment of this Act, and annually 
thereafter, the Commission shall submit to the Committee 
on Health, Education, Labor, and Pensions and the Com-
mittee on Finance of the Senate and the Committee on 
Energy and Commerce and the Committee on Ways and 
Means of the House of Representatives, a report on com-
pliance by and progress of independent health record 
trusts with this Act. Such report shall describe the fol-
lowing: 
(1) The number of complaints submitted about 
independent health record trusts, which shall be di-
vided by complaints related to security breaches, and 
complaints not related to security breaches, and may 
include other categories as the Interagency Steering 
Committee established under section (b) determines 
appropriate. 
(2) The number of enforcement actions under-
taken by the Commission against independent health 
record trusts in response to complaints under para-
graph (1), which shall be divided by enforcement ac-
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
tions related to security breaches and enforcement 
actions not related to security breaches and may in-
clude other categories as the Interagency Steering 
Committee established under section (b) determines 
appropriate. 
(3) The economic progress of the individual 
owner or institution operator as achieved through 
independent health record trust usage and existing 
barriers to such usage. 
(4) The progress in security auditing as pro-
vided for by the Interagency Steering Committee 
council under subsection (b). 
(5) The other core responsibilities of the Com-
mission as described in subsection (a). 
(g) 
INTERAGENCY
MEMORANDUM
OF
UNDER-
STANDING.—The Interagency Steering Committee shall 
ensure, through the execution of an interagency memo-
randum of understanding, that— 
(1) regulations, rulings, and interpretations 
issued by Federal officials relating to the same mat-
ter over which 2 or more such officials have respon-
sibility under this Act are administered so as to have 
the same effect at all times; and 
(2) the memorandum provides for the coordina-
tion of policies related to enforcing the same require-
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS
ments through such officials in order to have coordi-
nated enforcement strategy that avoids duplication 
of enforcement efforts and assigns priorities in en-
forcement. 
Æ 
VerDate Aug 31 2005 
23:43 Jul 13, 2007
Jkt 059200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6301
E:\BILLS\H2991.IH
H2991
ccoleman on PROD1PC69 with BILLS