532 
organization is a meaningful EHR user (as de-
fined in section 1848(o)(2)) for a year specified 
by the Secretary; and 
‘‘(B) whether each eligible hospital de-
scribed in subsection (m)(1), with respect to 
such organization, is a meaningful EHR user 
(as defined in section 1886(n)(3)) for an appli-
cable period specified by the Secretary.’’. 
(d) CONFORMING AMENDMENTS.—Section 1853 of 
the Social Security Act (42 U.S.C. 1395w–23) is amend-
ed— 
(1) in subsection (a)(1)(A), by striking ‘‘and 
(i)’’ and inserting ‘‘(i), and (l)’’; 
(2) in subsection (c)— 
(A) in paragraph (1)(D)(i), by striking 
‘‘section 1886(h)’’ and inserting ‘‘sections 
1848(o) and 1886(h)’’; and 
(B) in paragraph (6)(A), by inserting after 
‘‘under part B,’’ the following: ‘‘excluding ex-
penditures attributable to subsections (a)(7) 
and (o) of section 1848,’’; and 
(3) in subsection (f), by inserting ‘‘and for pay-
ments under subsection (l)’’ after ‘‘with the organi-
zation’’.
533 
(e) 
CONFORMING
AMENDMENTS
TO
E-PRE-
SCRIBING.— 
(1) Section 1848(a)(5)(A) of the Social Security 
Act (42 U.S.C. 1395w–4(a)(5)(A)) is amended— 
(A) in clause (i), by striking ‘‘or any sub-
sequent year’’ and inserting ‘‘, 2013, 2014, or 
2015’’; and 
(B) in clause (ii), by striking ‘‘and each 
subsequent year’’ and inserting ‘‘and 2015’’. 
(2) Section 1848(m)(2) of such Act (42 U.S.C. 
1395w–4(m)(2)) is amended— 
(A) in subparagraph (A), by striking ‘‘For 
2009’’ and inserting ‘‘Subject to subparagraph 
(D), for 2009’’; and 
(B) by adding at the end the following new 
subparagraph: 
‘‘(D) LIMITATION WITH RESPECT TO EHR 
INCENTIVE PAYMENTS.—The provisions of this 
paragraph shall not apply to an eligible profes-
sional (or, in the case of a group practice under 
paragraph (3)(C), to the group practice) if, for 
the reporting period the eligible professional (or 
group practice) receives an incentive payment 
under subsection (o)(1)(A) with respect to a 
certified EHR technology (as defined in sub-
534 
section (o)(4)) that has the capability of elec-
tronic prescribing.’’. 
SEC. 4312. INCENTIVES FOR HOSPITALS. 
(a) INCENTIVE PAYMENT.—Section 1886 of the So-
cial Security Act (42 U.S.C. 1395ww) is amended by add-
ing at the end the following new subsection: 
‘‘(n) INCENTIVES FOR ADOPTION AND MEANINGFUL 
USE OF CERTIFIED EHR TECHNOLOGY.— 
‘‘(1) IN GENERAL.—Subject to the succeeding 
provisions of this subsection, with respect to inpa-
tient hospital services furnished by an eligible hos-
pital during a payment year (as defined in para-
graph (2)(G)), if the eligible hospital is a meaningful 
EHR user (as determined under paragraph (3)) for 
the reporting period with respect to such year, in ad-
dition to the amount otherwise paid under this sec-
tion, there also shall be paid to the eligible hospital, 
from the Federal Hospital Insurance Trust Fund es-
tablished under section 1817, an amount equal to 
the applicable amount specified in paragraph (2)(A) 
for the hospital for such payment year. 
‘‘(2) PAYMENT AMOUNT.— 
‘‘(A) IN
GENERAL.—Subject to the suc-
ceeding subparagraphs of this paragraph, the 
applicable amount specified in this subpara-
535 
graph for an eligible hospital for a payment 
year is equal to the product of the following: 
‘‘(i) INITIAL AMOUNT.—The sum of— 
‘‘(I) the base amount specified in 
subparagraph (B); plus 
‘‘(II) 
the 
discharge 
related 
amount specified in subparagraph (C) 
for a 12-month period selected by the 
Secretary with respect to such pay-
ment year. 
‘‘(ii) MEDICARE
SHARE.—The Medi-
care share as specified in subparagraph 
(D) for the hospital for a period selected 
by the Secretary with respect to such pay-
ment year. 
‘‘(iii) 
TRANSITION
FACTOR.—The 
transition factor specified in subparagraph 
(E) for the hospital for the payment year. 
‘‘(B) BASE
AMOUNT.—The base amount 
specified in this subparagraph is $2,000,000. 
‘‘(C) DISCHARGE RELATED AMOUNT.—The 
discharge related amount specified in this sub-
paragraph for a 12-month period selected by 
the Secretary shall be determined as the sum of 
the amount, based upon total discharges (re-
536 
gardless of any source of payment) for the pe-
riod, for each discharge up to the 23,000th dis-
charge as follows: 
‘‘(i) For the 1,150th through the 
23,000th discharge, $200. 
‘‘(ii) For any discharge greater than 
the 23,000th, $0. 
‘‘(D) MEDICARE
SHARE.—The Medicare 
share specified under this subparagraph for a 
hospital for a period selected by the Secretary 
for a payment year is equal to the fraction— 
‘‘(i) the numerator of which is the 
sum (for such period and with respect to 
the hospital) of— 
‘‘(I) the number of inpatient-bed- 
days (as established by the Secretary) 
which are attributable to individuals 
with respect to whom payment may be 
made under part A; and 
‘‘(II) the number of inpatient- 
bed-days (as so established) which are 
attributable to individuals who are en-
rolled with a Medicare Advantage or-
ganization under part C; and
537 
‘‘(ii) the denominator of which is the 
product of— 
‘‘(I) the total number of inpa-
tient-bed-days with respect to the hos-
pital during such period; and 
‘‘(II) the total amount of the hos-
pital’s charges during such period, not 
including any charges that are attrib-
utable to charity care (as such term is 
used for purposes of hospital cost re-
porting under this title), divided by 
the total amount of the hospital’s 
charges during such period. 
Insofar as the Secretary determines that data 
are not available on charity care necessary to 
calculate the portion of the formula specified in 
clause (ii)(II), the Secretary shall use data on 
uncompensated care and may adjust such data 
so as to be an appropriate proxy for charity 
care including a downward adjustment to elimi-
nate bad debt data from uncompensated care 
data. In the absence of the data necessary, with 
respect to a hospital, for the Secretary to com-
pute the amount described in clause (ii)(II), the 
amount under such clause shall be deemed to
538 
be 1. In the absence of data, with respect to a 
hospital, necessary to compute the amount de-
scribed in clause (i)(II), the amount under such 
clause shall be deemed to be 0. 
‘‘(E) TRANSITION FACTOR SPECIFIED.— 
‘‘(i) IN GENERAL.—Subject to clause 
(ii), the transition factor specified in this 
subparagraph for an eligible hospital for a 
payment year is as follows: 
‘‘(I) For the first payment year 
for such hospital, 1. 
‘‘(II) For the second payment 
year for such hospital, 3⁄4. 
‘‘(III) For the third payment 
year for such hospital, 1⁄2. 
‘‘(IV) For the fourth payment 
year for such hospital, 1⁄4. 
‘‘(V) For any succeeding pay-
ment year for such hospital, 0. 
‘‘(ii) PHASE
DOWN
FOR
ELIGIBLE 
HOSPITALS FIRST ADOPTING EHR AFTER 
2013.—If the first payment year for an eli-
gible hospital is after 2013, then the tran-
sition factor specified in this subparagraph 
for a payment year for such hospital is the
539 
same as the amount specified in clause (i) 
for such payment year for an eligible hos-
pital for which the first payment year is 
2013. If the first payment year for an eli-
gible hospital is after 2015 then the transi-
tion factor specified in this subparagraph 
for such hospital and for such year and 
any subsequent year shall be 0. 
‘‘(F) FORM OF PAYMENT.—The payment 
under this subsection for a payment year may 
be in the form of a single consolidated payment 
or in the form of such periodic installments as 
the Secretary may specify. 
‘‘(G) PAYMENT YEAR DEFINED.— 
‘‘(i) IN
GENERAL.—For purposes of 
this subsection, the term ‘payment year’ 
means a fiscal year beginning with fiscal 
year 2011. 
‘‘(ii) FIRST, SECOND, ETC. PAYMENT 
YEAR.—The term ‘first payment year’ 
means, with respect to inpatient hospital 
services furnished by an eligible hospital, 
the first fiscal year for which an incentive 
payment is made for such services under 
this subsection. The terms ‘second pay-
540 
ment year’, ‘third payment year’, and 
‘fourth payment year’ mean, with respect 
to an eligible hospital, each successive year 
immediately following the first payment 
year for that hospital. 
‘‘(3) MEANINGFUL EHR USER.— 
‘‘(A) IN GENERAL.—For purposes of para-
graph (1), an eligible hospital shall be treated 
as a meaningful EHR user for a reporting pe-
riod for a payment year (or, for purposes of 
subsection (b)(3)(B)(ix), for a reporting period 
under such subsection for a fiscal year) if each 
of the following requirements are met: 
‘‘(i) MEANINGFUL USE OF CERTIFIED 
EHR TECHNOLOGY.—The eligible hospital 
demonstrates to the satisfaction of the Sec-
retary, in accordance with subparagraph 
(C)(i), that during such period the hospital 
is using certified EHR technology in a 
meaningful manner. 
‘‘(ii) INFORMATION EXCHANGE.—The 
eligible hospital demonstrates to the satis-
faction of the Secretary, in accordance 
with subparagraph (C)(i), that during such 
period such certified EHR technology is
541 
connected in a manner that provides, in 
accordance with law and standards appli-
cable to the exchange of information, for 
the electronic exchange of health informa-
tion to improve the quality of health care, 
such as promoting care coordination. 
‘‘(iii) 
REPORTING
ON
MEASURES 
USING
EHR.—Subject to subparagraph 
(B)(ii) and using such certified EHR tech-
nology, the eligible hospital submits infor-
mation for such period, in a form and 
manner specified by the Secretary, on such 
clinical quality measures and such other 
measures as selected by the Secretary 
under subparagraph (B)(i). 
The Secretary shall seek to improve the use of 
electronic health records and health care quality 
over time by requiring more stringent measures 
of meaningful use selected under this para-
graph. 
‘‘(B) REPORTING ON MEASURES.— 
‘‘(i) SELECTION.—The Secretary shall 
select measures for purposes of subpara-
graph (A)(iii) but only consistent with the 
following:
542 
‘‘(I) The Secretary shall provide 
preference to clinical quality measures 
that have been selected for purposes 
of applying subsection (b)(3)(B)(viii) 
or that have been endorsed by the en-
tity with a contract with the Secretary 
under section 1890(a). 
‘‘(II) Prior to any measure (other 
than a clinical quality measure that 
has been selected for purposes of ap-
plying 
subsection 
(b)(3)(B)(viii)) 
being selected under this subpara-
graph, the Secretary shall publish in 
the Federal Register such measure 
and provide for a period of public 
comment on such measure. 
‘‘(ii) LIMITATIONS.—The Secretary 
may not require the electronic reporting of 
information on clinical quality measures 
under subparagraph (A)(iii) unless the 
Secretary has the capacity to accept the in-
formation electronically, which may be on 
a pilot basis. 
‘‘(iii) COORDINATION OF REPORTING 
OF
INFORMATION.—In 
selecting 
such
543 
measures, and in establishing the form and 
manner for reporting measures under sub-
paragraph (A)(iii), the Secretary shall seek 
to avoid redundant or duplicative reporting 
with reporting otherwise required, includ-
ing 
reporting 
under 
subsection 
(b)(3)(B)(viii). 
‘‘(C) DEMONSTRATION
OF
MEANINGFUL 
USE OF CERTIFIED EHR TECHNOLOGY AND IN-
FORMATION EXCHANGE.— 
‘‘(i) IN
GENERAL.—A hospital may 
satisfy the demonstration requirement of 
clauses (i) and (ii) of subparagraph (A) 
through means specified by the Secretary, 
which may include— 
‘‘(I) an attestation; 
‘‘(II) the submission of claims 
with appropriate coding (such as a 
code indicating that inpatient care 
was documented using certified EHR 
technology); 
‘‘(III) a survey response; 
‘‘(IV) reporting under subpara-
graph (A)(iii); and
544 
‘‘(V) other means specified by the 
Secretary. 
‘‘(ii) USE
OF
PART
D
DATA.—Not-
withstanding sections 1860D–15(d)(2)(B) 
and 1860D–15(f)(2), the Secretary may 
use data regarding drug claims submitted 
for purposes of section 1860D–15 that are 
necessary for purposes of subparagraph 
(A). 
‘‘(4) APPLICATION.— 
‘‘(A) LIMITATIONS
ON
REVIEW.—There 
shall be no administrative or judicial review 
under section 1869, section 1878, or otherwise 
of the determination of any incentive payment 
under this subsection and the payment adjust-
ment under subsection (b)(3)(B)(ix), including 
the determination of a meaningful EHR user 
under paragraph (3), determination of meas-
ures applicable to services furnished by eligible 
hospitals under this subsection, and the excep-
tion under subsection (b)(3)(B)(ix)(II). 
‘‘(B) POSTING
ON
WEBSITE.—The Sec-
retary shall post on the Internet website of the 
Centers for Medicare & Medicaid Services, in an 
easily understandable format, a list of the
545 
names of the eligible hospitals that are mean-
ingful EHR users under this subsection or sub-
section (b)(3)(B)(ix) and other relevant data as 
determined appropriate by the Secretary. The 
Secretary shall ensure that a hospital has the 
opportunity to review the other relevant data 
that are to be made public with respect to the 
hospital prior to such data being made public. 
‘‘(5) CERTIFIED EHR TECHNOLOGY DEFINED.— 
The term ‘certified EHR technology’ has the mean-
ing given such term in section 1848(o)(4). 
‘‘(6) DEFINITIONS.—For purposes of this sub-
section: 
‘‘(A) ELIGIBLE HOSPITAL.—The term ‘eli-
gible hospital’ means a subsection (d) hospital. 
‘‘(B) REPORTING PERIOD.—The term ‘re-
porting period’ means any period (or periods), 
with respect to a payment year, as specified by 
the Secretary.’’. 
(b) INCENTIVE MARKET BASKET ADJUSTMENT.— 
Section 1886(b)(3)(B) of the Social Security Act (42 
U.S.C. 1395ww(b)(3)(B)) is amended— 
(1) in clause (viii)(I), by inserting ‘‘(or, begin-
ning with fiscal year 2016, by one-quarter)’’ after 
‘‘2.0 percentage points’’; and
546 
(2) by adding at the end the following new 
clause: 
‘‘(ix)(I) For purposes of clause (i) for fiscal year 
2016 and each subsequent fiscal year, in the case of an 
eligible hospital (as defined in subsection (n)(6)(A)) that 
is not a meaningful EHR user (as defined in subsection 
(n)(3)) for the reporting period for such fiscal year, three- 
quarters of the applicable percentage increase otherwise 
applicable under clause (i) for such fiscal year shall be 
reduced by 331⁄3 percent for fiscal year 2016, 662⁄3 per-
cent for fiscal year 2017, and 100 percent for fiscal year 
2018 and each subsequent fiscal year. Such reduction 
shall apply only with respect to the fiscal year involved 
and the Secretary shall not take into account such reduc-
tion in computing the applicable percentage increase under 
clause (i) for a subsequent fiscal year. 
‘‘(II) The Secretary may, on a case-by-case basis, ex-
empt a subsection (d) hospital from the application of sub-
clause (I) with respect to a fiscal year if the Secretary 
determines, subject to annual renewal, that requiring such 
hospital to be a meaningful EHR user during such fiscal 
year would result in a significant hardship, such as in the 
case of a hospital in a rural area without sufficient Inter-
net access. In no case may a hospital be granted an ex-
emption under this subclause for more than 5 years.
547 
‘‘(III) For fiscal year 2016 and each subsequent fis-
cal year, a State in which hospitals are paid for services 
under section 1814(b)(3) shall adjust the payments to 
each subsection (d) hospital in the State that is not a 
meaningful EHR user (as defined in subsection (n)(3)) 
in a manner that is designed to result in an aggregate 
reduction in payments to hospitals in the State that is 
equivalent to the aggregate reduction that would have oc-
curred if payments had been reduced to each subsection 
(d) hospital in the State in a manner comparable to the 
reduction under the previous provisions of this clause. The 
State shall report to the Secretary the methodology it will 
use to make the payment adjustment under the previous 
sentence. 
‘‘(IV) For purposes of this clause, the term ‘reporting 
period’ means, with respect to a fiscal year, any period 
(or periods), with respect to the fiscal year, as specified 
by the Secretary.’’. 
(c) APPLICATION
TO CERTAIN HMO-AFFILIATED 
ELIGIBLE HOSPITALS.—Section 1853 of the Social Secu-
rity Act (42 U.S.C. 1395w–23), as amended by section 
4311(c), is further amended by adding at the end the fol-
lowing new subsection: 
‘‘(m) APPLICATION OF ELIGIBLE HOSPITAL INCEN-
TIVES FOR CERTAIN MA ORGANIZATIONS FOR ADOPTION
548 
AND MEANINGFUL USE
OF CERTIFIED EHR TECH-
NOLOGY.— 
‘‘(1) APPLICATION.—Subject to paragraphs (3) 
and (4), in the case of a qualifying MA organization, 
the 
provisions 
of 
sections 
1886(n) 
and 
1886(b)(3)(B)(ix) shall apply with respect to eligible 
hospitals described in paragraph (2) of the organiza-
tion which the organization attests under subsection 
(l)(6) to be meaningful EHR users in a similar man-
ner as they apply to eligible hospitals under such 
sections. Incentive payments under paragraph (3) 
shall be made to and payment adjustments under 
paragraph (4) shall apply to such qualifying organi-
zations. 
‘‘(2) ELIGIBLE
HOSPITAL
DESCRIBED.—With 
respect to a qualifying MA organization, an eligible 
hospital described in this paragraph is an eligible 
hospital that is under common corporate governance 
with such organization and serves individuals en-
rolled under an MA plan offered by such organiza-
tion. 
‘‘(3) ELIGIBLE
HOSPITAL
INCENTIVE
PAY-
MENTS.— 
‘‘(A) IN
GENERAL.—In applying section 
1886(n)(2) under paragraph (1), instead of the
549 
additional payment amount under section 
1886(n)(2), there shall be substituted an 
amount determined by the Secretary to be simi-
lar to the estimated amount in the aggregate 
that would be payable if payment for services 
furnished by such hospitals was payable under 
part A instead of this part. In implementing the 
previous sentence, the Secretary— 
‘‘(i) shall, insofar as data to deter-
mine the discharge related amount under 
section 1886(n)(2)(C) for an eligible hos-
pital are not available to the Secretary, use 
such alternative data and methodology to 
estimate such discharge related amount as 
the Secretary determines appropriate; and 
‘‘(ii) shall, insofar as data to deter-
mine the medicare share described in sec-
tion 1886(n)(2)(D) for an eligible hospital 
are not available to the Secretary, use such 
alternative data and methodology to esti-
mate such share, which data and method-
ology may include use of the inpatient bed 
days (or discharges) with respect to an eli-
gible hospital during the appropriate pe-
riod which are attributable to both individ-
550 
uals for whom payment may be made 
under part A or individuals enrolled in an 
MA plan under a Medicare Advantage or-
ganization under this part as a proportion 
of the total number of patient-bed-days (or 
discharges) with respect to such hospital 
during such period. 
‘‘(B) AVOIDING
DUPLICATION
OF
PAY-
MENTS.— 
‘‘(i) IN GENERAL.—In the case of a 
hospital that for a payment year is an eli-
gible hospital described in paragraph (2), 
is an eligible hospital under section 
1886(n), and for which at least one-third 
of their discharges (or bed-days) of Medi-
care patients for the year are covered 
under part A, payment for the payment 
year shall be made only under section 
1886(n) and not under this subsection. 
‘‘(ii) METHODS.—In the case of a 
hospital that is an eligible hospital de-
scribed in paragraph (2) and also is eligi-
ble for an incentive payment under section 
1886(n) but is not described in clause (i)
551 
for the same payment period, the Secretary 
shall develop a process— 
‘‘(I) to ensure that duplicate pay-
ments are not made with respect to 
an eligible hospital both under this 
subsection and under section 1886(n); 
and 
‘‘(II) to collect data from Medi-
care Advantage organizations to en-
sure against such duplicate payments. 
‘‘(4) PAYMENT ADJUSTMENT.— 
‘‘(A) Subject to paragraph (3), in the case 
of a qualifying MA organization (as defined in 
section 1853(l)(5)), if, according to the attesta-
tion of the organization submitted under sub-
section (l)(6) for an applicable period, one or 
more eligible hospitals (as defined in section 
1886(n)(6)(A)) that are under common cor-
porate governance with such organization and 
that serve individuals enrolled under a plan of-
fered by such organization are not meaningful 
EHR users (as defined in section 1886(n)(3)) 
with respect to a period, the payment amount 
payable under this section for such organization 
for such period shall be the percent specified in
552 
subparagraph (B) for such period of the pay-
ment amount otherwise provided under this sec-
tion for such period. 
‘‘(B) SPECIFIED
PERCENT.—The percent 
specified under this subparagraph for a year is 
100 percent minus a number of percentage 
points equal to the product of— 
‘‘(i) the number of the percentage 
point reduction effected under section 
1886(b)(3)(B)(ix)(I) for the period; and 
‘‘(ii) the Medicare hospital expendi-
ture proportion specified in subparagraph 
(C) for the year. 
‘‘(C) MEDICARE HOSPITAL EXPENDITURE 
PROPORTION.—The Medicare hospital expendi-
ture proportion under this subparagraph for a 
year is the Secretary’s estimate of the propor-
tion, of the expenditures under parts A and B 
that are not attributable to this part, that are 
attributable to expenditures for inpatient hos-
pital services. 
‘‘(D) APPLICATION OF PAYMENT ADJUST-
MENT.—In the case that a qualifying MA orga-
nization attests that not all eligible hospitals 
are meaningful EHR users with respect to an
553 
applicable period, the Secretary shall apply the 
payment adjustment under this paragraph 
based on a methodology specified by the Sec-
retary, taking into account the proportion of 
such eligible hospitals, or discharges from such 
hospitals, that are not meaningful EHR users 
for such period.’’. 
(d) CONFORMING AMENDMENTS.— 
(1) Section 1814(b) of the Social Security Act 
(42 U.S.C. 1395f(b)) is amended— 
(A) in paragraph (3), in the matter pre-
ceding subparagraph (A), by inserting ‘‘, sub-
ject to section 1886(d)(3)(B)(ix)(III),’’ after 
‘‘then’’; and 
(B) by adding at the end the following: 
‘‘For purposes of applying paragraph (3), there 
shall be taken into account incentive payments, 
and payment adjustments under subsection 
(b)(3)(B)(ix) or (n) of section 1886.’’. 
(2) Section 1851(i)(1) of the Social Security 
Act (42 U.S.C. 1395w–21(i)(1)) is amended by 
striking 
‘‘and 
1886(h)(3)(D)’’ 
and 
inserting 
‘‘1886(h)(3)(D), and 1853(m)’’.
554 
(3) Section 1853 of the Social Security Act (42 
U.S.C. 
1395w–23), 
as 
amended 
by 
section 
4311(d)(1), is amended— 
(A) in subsection (c)— 
(i) in paragraph (1)(D)(i), by striking 
‘‘1848(o)’’ and inserting ‘‘, 1848(o), and 
1886(n)’’; and 
(ii) in paragraph (6)(A), by inserting 
‘‘and subsections (b)(3)(B)(ix) and (n) of 
section 1886’’ after ‘‘section 1848’’; and 
(B) in subsection (f), by inserting ‘‘and 
subsection (m)’’ after ‘‘under subsection (l)’’. 
SEC. 4313. TREATMENT OF PAYMENTS AND SAVINGS; IM-
PLEMENTATION FUNDING. 
(a) PREMIUM HOLD HARMLESS.— 
(1) IN GENERAL.—Section 1839(a)(1) of the 
Social Security Act (42 U.S.C. 1395r(a)(1)) is 
amended by adding at the end the following: ‘‘In ap-
plying this paragraph there shall not be taken into 
account additional payments under section 1848(o) 
and section 1853(l)(3) and the Government con-
tribution under section 1844(a)(3).’’. 
(2) PAYMENT.—Section 1844(a) of such Act 
(42 U.S.C. 1395w(a)) is amended—
555 
(A) in paragraph (2), by striking the pe-
riod at the end and inserting ‘‘; plus’’; and 
(B) by adding at the end the following new 
paragraph: 
‘‘(3) a Government contribution equal to the 
amount of payment incentives payable under sec-
tions 1848(o) and 1853(l)(3).’’. 
(b) MEDICARE IMPROVEMENT FUND.—Section 1898 
of the Social Security Act (42 U.S.C. 1395iii), as added 
by section 7002(a) of the Supplemental Appropriations 
Act, 2008 (Public Law 110–252) and as amended by sec-
tion 188(a)(2) of the Medicare Improvements for Patients 
and Providers Act of 2008 (Public Law 110–275; 122 
Stat. 2589) and by section 6 of the QI Program Supple-
mental Funding Act of 2008, is amended— 
(1) in subsection (a)— 
(A) by inserting ‘‘medicare’’ before ‘‘fee- 
for-service’’; and 
(B) by inserting before the period at the 
end the following: ‘‘including, but not limited 
to, an increase in the conversion factor under 
section 1848(d) to address, in whole or in part, 
any projected shortfall in the conversion factor 
for 2014 relative to the conversion factor for 
2008 and adjustments to payments for items
556 
and services furnished by providers of services 
and suppliers under such original medicare fee- 
for-service program’’; and 
(2) in subsection (b)— 
(A) in paragraph (1), by striking ‘‘during 
fiscal year 2014,’’ and all that follows and in-
serting the following: ‘‘during— 
‘‘(A) fiscal year 2014, $22,290,000,000; 
and 
‘‘(B) fiscal year 2020 and each subsequent 
fiscal year, the Secretary’s estimate, as of July 
1 of the fiscal year, of the aggregate reduction 
in expenditures under this title during the pre-
ceding fiscal year directly resulting from the re-
duction in payment amounts under sections 
1848(a)(7), 
1853(l)(4), 
1853(m)(4), 
and 
1886(b)(3)(B)(ix).’’; and 
(B) by adding at the end the following new 
paragraph: 
‘‘(4) NO
EFFECT
ON
PAYMENTS
IN
SUBSE-
QUENT YEARS.—In the case that expenditures from 
the Fund are applied to, or otherwise affect, a pay-
ment rate for an item or service under this title for 
a year, the payment rate for such item or service
557 
shall be computed for a subsequent year as if such 
application or effect had never occurred.’’. 
(c) IMPLEMENTATION FUNDING.—In addition to 
funds otherwise available, out of any funds in the Treas-
ury not otherwise appropriated, there are appropriated to 
the Secretary of Health and Human Services for the Cen-
ter for Medicare & Medicaid Services Program Manage-
ment Account, $60,000,000 for each of fiscal years 2009 
through 2015 and $30,000,000 for each succeeding fiscal 
year through fiscal year 2019, which shall be available for 
purposes of carrying out the provisions of (and amend-
ments made by) this part. Amounts appropriated under 
this subsection for a fiscal year shall be available until ex-
pended. 
SEC. 4314. STUDY ON APPLICATION OF EHR PAYMENT IN-
CENTIVES FOR PROVIDERS NOT RECEIVING 
OTHER INCENTIVE PAYMENTS. 
(a) STUDY.— 
(1) IN GENERAL.—The Secretary of Health and 
Human Services shall conduct a study to determine 
the extent to which and manner in which payment 
incentives (such as under title XVIII or XIX of the 
Social Security Act) and other funding for purposes 
of implementing and using certified EHR technology 
(as defined in section 3000 of the Public Health
558 
Service Act) should be made available to health care 
providers who are receiving minimal or no payment 
incentives or other funding under this Act, under 
title XVIII or XIX of the Social Security Act, or 
otherwise, for such purposes. 
(2) DETAILS OF STUDY.—Such study shall in-
clude an examination of— 
(A) the adoption rates of certified EHR 
technology by such health care providers; 
(B) the clinical utility of such technology 
by such health care providers; 
(C) whether the services furnished by such 
health care providers are appropriate for or 
would benefit from the use of such technology; 
(D) the extent to which such health care 
providers work in settings that might otherwise 
receive an incentive payment or other funding 
under this Act, title XVIII or XIX of the Social 
Security Act, or otherwise; 
(E) the potential costs and the potential 
benefits of making payment incentives and 
other funding available to such health care pro-
viders; and 
(F) any other issues the Secretary deems 
to be appropriate.
559 
(b) REPORT.—Not later than June 30, 2010, the 
Secretary shall submit to Congress a report on the find-
ings and conclusions of the study conducted under sub-
section (a). 
PART III—MEDICAID FUNDING 
SEC. 4321. MEDICAID PROVIDER HIT ADOPTION AND OPER-
ATION PAYMENTS; IMPLEMENTATION FUND-
ING. 
(a) IN GENERAL.—Section 1903 of the Social Secu-
rity Act (42 U.S.C. 1396b) is amended— 
(1) in subsection (a)(3)— 
(A) by striking ‘‘and’’ at the end of sub-
paragraph (D); 
(B) by striking ‘‘plus’’ at the end of sub-
paragraph (E) and inserting ‘‘and’’; and 
(C) by adding at the end the following new 
subparagraph: 
‘‘(F)(i) 100 percent of so much of the 
sums expended during such quarter as are at-
tributable to payments for certified EHR tech-
nology (and support services including mainte-
nance and training that is for, or is necessary 
for the adoption and operation of, such tech-
nology) by Medicaid providers described in sub-
section (t)(1); and
560 
‘‘(ii) 90 percent of so much of the sums ex-
pended during such quarter as are attributable 
to payments for reasonable administrative ex-
penses related to the administration of pay-
ments described in clause (i) if the State meets 
the condition described in subsection (t)(9); 
plus’’; and 
(2) by inserting after subsection (s) the fol-
lowing new subsection: 
‘‘(t)(1)(A) For purposes of subsection (a)(3)(F), the 
payments for certified EHR technology (and support serv-
ices including maintenance that is for, or is necessary for 
the operation of, such technology) by Medicaid providers 
described in this paragraph are payments made by the 
State in accordance with this subsection of the applicable 
percent (as specified in subparagraph (B)) of the net al-
lowable costs of Medicaid providers (as defined in para-
graph (2)) for such technology (and support services). 
‘‘(B) For purposes of subparagraph (A), the applica-
ble percent is— 
‘‘(i) in the case of a Medicaid provider de-
scribed in paragraph (2)(A), 85 percent; and 
‘‘(ii) in the case of a Medicaid provider de-
scribed in paragraph (2)(B), 100 percent.
561 
‘‘(2) In this subsection and subsection (a)(3)(F), the 
term ‘Medicaid provider’ means— 
‘‘(A) an eligible professional (as defined in 
paragraph (3)(B)) who is not hospital-based and has 
at least 30 percent of the professional’s patient vol-
ume (as estimated in accordance with standards es-
tablished by the Secretary) attributable to individ-
uals who are receiving medical assistance under this 
title; and 
‘‘(B)(i) a children’s hospital, (ii) an acute-care 
hospital that is not described in clause (i) and that 
has at least 10 percent of the hospital’s patient vol-
ume (as estimated in accordance with standards es-
tablished by the Secretary) attributable to individ-
uals who are receiving medical assistance under this 
title, or (iii) a Federally-qualified health center or 
rural health clinic that has at least 30 percent of the 
center’s or clinic’s patient volume (as estimated in 
accordance with standards established by the Sec-
retary) attributable to individuals who are receiving 
medical assistance under this title. 
An eligible professional shall not qualify as a Medicaid 
provider under this subsection unless the eligible profes-
sional has waived, in a manner specified by the Secretary, 
any right to payment under section 1848(o) with respect
562 
to the adoption or support of certified EHR technology 
by the professional. In applying clauses (ii) and (iii) of 
subparagraph (B), the standards established by the Sec-
retary for patient volume shall include individuals enrolled 
in a Medicaid managed care plan (under section 1903(m) 
or section 1932). 
‘‘(3) In this subsection and subsection (a)(3)(F): 
‘‘(A) The term ‘certified EHR technology’ 
means a qualified electronic health record (as de-
fined in 3000(13) of the Public Health Service Act) 
that is certified pursuant to section 3001(c)(5) of 
such Act as meeting standards adopted under sec-
tion 3004 of such Act that are applicable to the type 
of record involved (as determined by the Secretary, 
such as an ambulatory electronic health record for 
office-based physicians or an inpatient hospital elec-
tronic health record for hospitals). 
‘‘(B) The term ‘eligible professional’ means a 
physician as defined in paragraphs (1) and (2) of 
section 1861(r), and includes a certified nurse mid- 
wife and a nurse practitioner. 
‘‘(C) The term ‘hospital-based’ means, with re-
spect to an eligible professional, a professional (such 
as a pathologist, anesthesiologist, or emergency phy-
sician) who furnishes substantially all of the individ-
563 
ual’s professional services in a hospital setting 
(whether inpatient or outpatient) and through the 
use of the facilities and equipment, including com-
puter equipment, of the hospital. 
‘‘(4)(A) The term ‘allowable costs’ means, with re-
spect to certified EHR technology of a Medicaid provider, 
costs of such technology (and support services including 
maintenance and training that is for, or is necessary for 
the adoption and operation of, such technology) as deter-
mined by the Secretary to be reasonable. 
‘‘(B) The term ‘net allowable costs’ means allowable 
costs reduced by any payment that is made to the Med-
icaid provider involved from any other source that is di-
rectly attributable to payment for certified EHR tech-
nology or services described in subparagraph (A). 
‘‘(C) In no case shall— 
‘‘(i) the aggregate allowable costs under this 
subsection (covering one or more years) with respect 
to a Medicaid provider described in paragraph 
(2)(A) for purchase and initial implementation of 
certified EHR technology (and services described in 
subparagraph (A)) exceed $25,000 or include costs 
over a period of longer than 5 years; 
‘‘(ii) for costs not described in clause (i) relat-
ing to the operation, maintenance, or use of certified
564 
EHR technology, the annual allowable costs under 
this subsection with respect to such a Medicaid pro-
vider for costs not described in clause (i) for any 
year exceed $10,000; 
‘‘(iii) payment described in paragraph (1) for 
costs described in clause (ii) be made with respect 
to such a Medicaid provider over a period of more 
than 5 years; 
‘‘(iv) the aggregate allowable costs under this 
subsection with respect to such a Medicaid provider 
for all costs exceed $75,000; or 
‘‘(v) the allowable costs, whether for purchase 
and initial implementation, maintenance, or other-
wise, for a Medicaid provider described in paragraph 
(2)(B)(iii) exceed such aggregate or annual limita-
tion as the Secretary shall establish, based on an 
amount determined by the Secretary as being ade-
quate to adopt and maintain certified EHR tech-
nology, consistent with paragraph (6). 
‘‘(5) Payments described in paragraph (1) are not in 
accordance with this subsection unless the following re-
quirements are met: 
‘‘(A) The State provides assurances satisfactory 
to the Secretary that amounts received under sub-
section (a)(3)(F) with respect to costs of a Medicaid
565 
provider are paid directly to such provider without 
any deduction or rebate. 
‘‘(B) Such Medicaid provider is responsible for 
payment of the costs described in such paragraph 
that are not provided under this title. 
‘‘(C) With respect to payments to such Med-
icaid provider for costs other than costs related to 
the initial adoption of certified EHR technology, the 
Medicaid provider demonstrates meaningful use of 
certified EHR technology through a means that is 
approved by the State and acceptable to the Sec-
retary, and that may be based upon the methodolo-
gies applied under section 1848(o) or 1886(n). 
‘‘(D) To the extent specified by the Secretary, 
the certified EHR technology is compatible with 
State or Federal administrative management sys-
tems. 
‘‘(6)(A) In no case shall the payments described in 
paragraph (1), with respect to a hospital, exceed in the 
aggregate the product of— 
‘‘(i) the overall hospital EHR amount for the 
hospital computed under subparagraph (B); and 
‘‘(ii) the Medicaid share for such hospital com-
puted under subparagraph (C).
566 
‘‘(B) For purposes of this paragraph, the overall hos-
pital EHR amount, with respect to a hospital, is the sum 
of 
the 
applicable 
amounts 
specified 
in 
section 
1886(n)(2)(A) for such hospital for the first 4 payment 
years (as estimated by the Secretary) determined as if the 
Medicare share specified in clause (ii) of such section were 
1. The Secretary shall publish in the Federal Register the 
overall hospital EHR amount for each hospital eligible for 
payments under this subsection. In computing amounts 
under paragraph 1886(n)(2)(C) for payment years after 
the first payment year, the Secretary shall assume that 
in subsequent payment years discharges increase at the 
average annual rate of growth of the most recent 3 years 
for which discharge data are available per year. 
‘‘(C) The Medicaid share computed under this sub-
paragraph, for a hospital for a period specified by the Sec-
retary, shall be calculated in the same manner as the 
Medicare share under section 1886(n)(2)(D) for such a 
hospital and period, except that there shall be substituted 
for the numerator under clause (i) of such section the 
amount that is equal to the number of inpatient-bed-days 
(as established by the Secretary) which are attributable 
to individuals who are receiving medical assistance under 
this title and who are not described in section 
1886(n)(2)(D)(i). In computing inpatient-bed-days under
567 
the previous sentence, the Secretary shall take into ac-
count inpatient-bed-days attributable to inpatient-bed- 
days that are paid for individuals enrolled in a Medicaid 
managed care plan (under section 1903(m) or section 
1932). 
‘‘(7) With respect to health care providers other than 
hospitals, the Secretary shall ensure coordination of the 
different programs for payment of such health care pro-
viders for adoption or use of health information technology 
(including certified EHR technology), as well as payments 
for such health care providers provided under this title or 
title XVIII, to assure no duplication of funding. 
‘‘(8) In carrying out paragraph (5)(C), the State and 
Secretary shall seek, to the maximum extent practicable, 
to avoid duplicative requirements from Federal and State 
Governments to demonstrate meaningful use of certified 
EHR technology under this title and title XVIII. In doing 
so, the Secretary may deem satisfaction of requirements 
for such meaningful use for a payment year under title 
XVIII to be sufficient to qualify as meaningful use under 
this subsection. The Secretary may also specify the report-
ing periods under this subsection in order to carry out this 
paragraph. 
‘‘(9) In order to be provided Federal financial partici-
pation under subsection (a)(3)(F)(ii), a State must dem-
568 
onstrate to the satisfaction of the Secretary, that the 
State— 
‘‘(A) is using the funds provided for the pur-
poses of administering payments under this sub-
section, including tracking of meaningful use by 
Medicaid providers; 
‘‘(B) is conducting adequate oversight of the 
program under this subsection, including routine 
tracking of meaningful use attestations and report-
ing mechanisms; and 
‘‘(C) is pursuing initiatives to encourage the 
adoption of certified EHR technology to promote 
health care quality and the exchange of health care 
information under this title, subject to applicable 
laws and regulations governing such exchange. 
‘‘(10) The Secretary shall periodically submit reports 
to the Committee on Energy and Commerce of the House 
of Representatives and the Committee on Finance of the 
Senate on status, progress, and oversight of payments 
under paragraph (1).’’. 
(b) IMPLEMENTATION FUNDING.—In addition to 
funds otherwise available, out of any funds in the Treas-
ury not otherwise appropriated, there are appropriated to 
the Secretary of Health and Human Services for the Cen-
ter for Medicare & Medicaid Services Program Manage-
569 
ment Account, $40,000,000 for each of fiscal years 2009 
through 2015 and $20,000,000 for each succeeding fiscal 
year through fiscal year 2019, which shall be available for 
purposes of carrying out the provisions of (and the amend-
ments made by) this part. Amounts appropriated under 
this subsection for a fiscal year shall be available until ex-
pended. 
SEC. 4322. MEDICAID NURSING FACILITY GRANT PROGRAM. 
(a) IN GENERAL.—The Secretary shall establish a 
grant program to enhance the meaningful use of certified 
electronic health records in nursing facilities. In estab-
lishing such program, the Secretary shall use payment in-
centives for meaningful use of certified EHR technology, 
similar to those specified in sections 4311, 4312, and 
4321, as appropriate. For the purpose of such incentives, 
the Secretary shall define meaningful use in a manner so 
as to be consistent with such sections to the extent prac-
ticable. The Secretary shall award funds to not more than 
10 States to carry out activities under this section. 
(b) ACTIVITIES.—The Secretary shall require a State 
participating in the grant program to— 
(1) provide payment incentives to nursing facili-
ties contingent on the demonstration of meaningful 
use of certified electronic health records;
570 
(2) require participating nursing facilities to en-
gage in programs to improve the quality and coordi-
nation of care through the use of certified EHR 
technology, including for persons who are repeatedly 
admitted to acute care hospitals from the nursing 
facility and persons who receive services across mul-
tiple medical and social services providers (including 
facility and community-based providers); and 
(3) provide for training of appropriate per-
sonnel in the use of certified electronic health 
records. 
(c) TARGETING.—The Secretary shall require a State 
participating in the grant program to target nursing facili-
ties with a significant percentage (but not less than the 
average in the State) of the facility’s patient volume (as 
estimated in accordance with standards established by the 
Secretary) attributable to individuals who are receiving 
medical assistance under title XIX of the Social Security 
Act. 
(d) PRIORITY.—In making grants under this section, 
the Secretary shall give priority to States with a high pro-
portion of total national nursing facility days paid under 
title XIX of the Social Security Act. 
(e) LIMITATIONS ON USE OF FUNDS.—A State may 
not make payments to a nursing facility in excess of 90
571 
percent of the costs of such nursing facility for the adop-
tion and operation of certified EHR technology. 
(f) APPLICATION.—No grant may be made to a State 
under this section unless the State submits an application 
to the Secretary in a form and manner specified by the 
Secretary. 
(g) REPORT.—Not later than the end of the 3-year 
period beginning on the date that grants under this sec-
tion are first awarded, the Secretary shall submit a report 
to Congress on the activities under this grant program and 
the effect of this program on quality and coordination of 
care under title XIX of the Social Security Act. 
(h) APPROPRIATION.—Out of any money in the 
Treasury not otherwise appropriated, there is appro-
priated to the Secretary of Health and Human Services 
to carry out this section $600,000,000, to remain available 
until expended. 
Subtitle D—Privacy 
SEC. 4400. DEFINITIONS. 
In this subtitle, except as specified otherwise: 
(1) BREACH.—The term ‘‘breach’’ means the 
unauthorized acquisition, access, use, or disclosure 
of protected health information which compromises 
the security, privacy, or integrity of protected health 
information maintained by or on behalf of a person.
572 
Such term does not include any unintentional acqui-
sition, access, use, or disclosure of such information 
by an employee or agent of the covered entity or 
business associate involved if such acquisition, ac-
cess, use, or disclosure, respectively, was made in 
good faith and within the course and scope of the 
employment or other contractual relationship of such 
employee or agent, respectively, with the covered en-
tity or business associate and if such information is 
not further acquired, accessed, used, or disclosed by 
such employee or agent. 
(2) BUSINESS ASSOCIATE.—The term ‘‘business 
associate’’ has the meaning given such term in sec-
tion 160.103 of title 45, Code of Federal Regula-
tions. 
(3) COVERED ENTITY.—The term ‘‘covered en-
tity’’ has the meaning given such term in section 
160.103 of title 45, Code of Federal Regulations. 
(4) DISCLOSE.—The terms ‘‘disclose’’ and ‘‘dis-
closure’’ have the meaning given the term ‘‘disclo-
sure’’ in section 160.103 of title 45, Code of Federal 
Regulations. 
(5) ELECTRONIC HEALTH RECORD.—The term 
‘‘electronic health record’’ means an electronic 
record of health-related information on an individual
573 
that is created, gathered, managed, and consulted by 
authorized health care clinicians and staff. 
(6) HEALTH
CARE
OPERATIONS.—The term 
‘‘health care operation’’ has the meaning given such 
term in section 164.501 of title 45, Code of Federal 
Regulations. 
(7) HEALTH
CARE
PROVIDER.—The term 
‘‘health care provider’’ has the meaning given such 
term in section 160.103 of title 45, Code of Federal 
Regulations. 
(8) HEALTH PLAN.—The term ‘‘health plan’’ 
has the meaning given such term in section 1171(5) 
of the Social Security Act. 
(9) NATIONAL COORDINATOR.—The term ‘‘Na-
tional Coordinator’’ means the head of the Office of 
the National Coordinator for Health Information 
Technology established under section 3001(a) of the 
Public Health Service Act, as added by section 
4101. 
(10) PAYMENT.—The term ‘‘payment’’ has the 
meaning given such term in section 164.501 of title 
45, Code of Federal Regulations. 
(11) PERSONAL HEALTH RECORD.—The term 
‘‘personal health record’’ means an electronic record 
of individually identifiable health information on an
574 
individual that can be drawn from multiple sources 
and that is managed, shared, and controlled by or 
for the individual. 
(12) PROTECTED HEALTH INFORMATION.—The 
term ‘‘protected health information’’ has the mean-
ing given such term in section 160.103 of title 45, 
Code of Federal Regulations. 
(13) 
SECRETARY.—The 
term 
‘‘Secretary’’ 
means the Secretary of Health and Human Services. 
(14) SECURITY.—The term ‘‘security’’ has the 
meaning given such term in section 164.304 of title 
45, Code of Federal Regulations. 
(15) STATE.—The term ‘‘State’’ means each of 
the several States, the District of Columbia, Puerto 
Rico, the Virgin Islands, Guam, American Samoa, 
and the Northern Mariana Islands. 
(16) TREATMENT.—The term ‘‘treatment’’ has 
the meaning given such term in section 164.501 of 
title 45, Code of Federal Regulations. 
(17) USE.—The term ‘‘use’’ has the meaning 
given such term in section 160.103 of title 45, Code 
of Federal Regulations. 
(18) 
VENDOR
OF
PERSONAL
HEALTH 
RECORDS.—The term ‘‘vendor of personal health 
records’’ means an entity, other than a covered enti-
575 
ty (as defined in paragraph (3)), that offers or 
maintains a personal health record. 
PART I—IMPROVED PRIVACY PROVISIONS AND 
SECURITY PROVISIONS 
SEC. 4401. APPLICATION OF SECURITY PROVISIONS AND 
PENALTIES TO BUSINESS ASSOCIATES OF 
COVERED ENTITIES; ANNUAL GUIDANCE ON 
SECURITY PROVISIONS. 
(a) APPLICATION OF SECURITY PROVISIONS.—Sec-
tions 164.308, 164.310, 164.312, and 164.316 of title 45, 
Code of Federal Regulations, shall apply to a business as-
sociate of a covered entity in the same manner that such 
sections apply to the covered entity. The additional re-
quirements of this title that relate to security and that 
are made applicable with respect to covered entities shall 
also be applicable to such a business associate and shall 
be incorporated into the business associate agreement be-
tween the business associate and the covered entity. 
(b) APPLICATION
OF CIVIL
AND CRIMINAL PEN-
ALTIES.—In the case of a business associate that violates 
any security provision specified in subsection (a), sections 
1176 and 1177 of the Social Security Act (42 U.S.C. 
1320d–5, 1320d–6) shall apply to the business associate 
with respect to such violation in the same manner such
576 
sections apply to a covered entity that violates such secu-
rity provision. 
(c) ANNUAL GUIDANCE.—For the first year begin-
ning after the date of the enactment of this Act and annu-
ally thereafter, the Secretary of Health and Human Serv-
ices shall, in consultation with industry stakeholders, an-
nually issue guidance on the most effective and appro-
priate technical safeguards for use in carrying out the sec-
tions referred to in subsection (a) and the security stand-
ards in subpart C of part 164 of title 45, Code of Federal 
Regulations, including the use of standards developed 
under section 3002(b)(2)(B)(vi) of the Public Health 
Service Act, as added by section 4101, as such provisions 
are in effect as of the date before the enactment of this 
Act. 
SEC. 4402. NOTIFICATION IN THE CASE OF BREACH. 
(a) IN GENERAL.—A covered entity that accesses, 
maintains, retains, modifies, records, stores, destroys, or 
otherwise holds, uses, or discloses unsecured protected 
health information (as defined in subsection (h)(1)) shall, 
in the case of a breach of such information that is discov-
ered by the covered entity, notify each individual whose 
unsecured protected health information has been, or is 
reasonably believed by the covered entity to have been, 
accessed, acquired, or disclosed as a result of such breach.
577 
(b) NOTIFICATION OF COVERED ENTITY BY BUSI-
NESS ASSOCIATE.—A business associate of a covered enti-
ty that accesses, maintains, retains, modifies, records, 
stores, destroys, or otherwise holds, uses, or discloses un-
secured protected health information shall, following the 
discovery of a breach of such information, notify the cov-
ered entity of such breach. Such notice shall include the 
identification of each individual whose unsecured protected 
health information has been, or is reasonably believed by 
the business associate to have been, accessed, acquired, 
or disclosed during such breach. 
(c) BREACHES TREATED AS DISCOVERED.—For pur-
poses of this section, a breach shall be treated as discov-
ered by a covered entity or by a business associate as of 
the first day on which such breach is known to such entity 
or associate, respectively, (including any person, other 
than the individual committing the breach, that is an em-
ployee, officer, or other agent of such entity or associate, 
respectively) or should reasonably have been known to 
such entity or associate (or person) to have occurred. 
(d) TIMELINESS OF NOTIFICATION.— 
(1) IN GENERAL.—Subject to subsection (g), all 
notifications required under this section shall be 
made without unreasonable delay and in no case 
later than 60 calendar days after the discovery of a
578 
breach by the covered entity involved (or business 
associate involved in the case of a notification re-
quired under subsection (b)). 
(2) BURDEN OF PROOF.—The covered entity in-
volved (or business associate involved in the case of 
a notification required under subsection (b)), shall 
have the burden of demonstrating that all notifica-
tions were made as required under this part, includ-
ing evidence demonstrating the necessity of any 
delay. 
(e) METHODS OF NOTICE.— 
(1) 
INDIVIDUAL
NOTICE.—Notice 
required 
under this section to be provided to an individual, 
with respect to a breach, shall be provided promptly 
and in the following form: 
(A) Written notification by first-class mail 
to the individual (or the next of kin of the indi-
vidual if the individual is deceased) at the last 
known address of the individual or the next of 
kin, respectively, or, if specified as a preference 
by the individual, by electronic mail. The notifi-
cation may be provided in one or more mailings 
as information is available. 
(B) In the case in which there is insuffi-
cient, or out-of-date contact information (in-
579 
cluding a phone number, email address, or any 
other form of appropriate communication) that 
precludes direct written (or, if specified by the 
individual under subparagraph (A), electronic) 
notification to the individual, a substitute form 
of notice shall be provided, including, in the 
case that there are 10 or more individuals for 
which there is insufficient or out-of-date contact 
information, a conspicuous posting for a period 
determined by the Secretary on the home page 
of the Web site of the covered entity involved or 
notice in major print or broadcast media, in-
cluding major media in geographic areas where 
the individuals affected by the breach likely re-
side. Such a notice in media or web posting will 
include a toll-free phone number where an indi-
vidual can learn whether or not the individual’s 
unsecured protected health information is pos-
sibly included in the breach. 
(C) In any case deemed by the covered en-
tity involved to require urgency because of pos-
sible imminent misuse of unsecured protected 
health information, the covered entity, in addi-
tion to notice provided under subparagraph (A),
580 
may provide information to individuals by tele-
phone or other means, as appropriate. 
(2) MEDIA NOTICE.—Notice shall be provided 
to prominent media outlets serving a State or juris-
diction, following the discovery of a breach described 
in subsection (a), if the unsecured protected health 
information of more than 500 residents of such 
State or jurisdiction is, or is reasonably believed to 
have been, accessed, acquired, or disclosed during 
such breach. 
(3) NOTICE TO SECRETARY.—Notice shall be 
provided to the Secretary by covered entities of un-
secured protected health information that has been 
acquired or disclosed in a breach. If the breach was 
with respect to 500 or more individuals than such 
notice must be provided immediately. If the breach 
was with respect to less than 500 individuals, the 
covered entity involved may maintain a log of any 
such breach occurring and annually submit such a 
log to the Secretary documenting such breaches oc-
curring during the year involved. 
(4) POSTING ON HHS PUBLIC WEBSITE.—The 
Secretary shall make available to the public on the 
Internet website of the Department of Health and 
Human Services a list that identifies each covered
581 
entity involved in a breach described in subsection 
(a) in which the unsecured protected health informa-
tion of more than 500 individuals is acquired or dis-
closed. 
(f) CONTENT OF NOTIFICATION.—Regardless of the 
method by which notice is provided to individuals under 
this section, notice of a breach shall include, to the extent 
possible, the following: 
(1) A brief description of what happened, in-
cluding the date of the breach and the date of the 
discovery of the breach, if known. 
(2) A description of the types of unsecured pro-
tected health information that were involved in the 
breach (such as full name, Social Security number, 
date of birth, home address, account number, or dis-
ability code). 
(3) The steps individuals should take to protect 
themselves from potential harm resulting from the 
breach. 
(4) A brief description of what the covered enti-
ty involved is doing to investigate the breach, to 
mitigate losses, and to protect against any further 
breaches. 
(5) Contact procedures for individuals to ask 
questions or learn additional information, which
582 
shall include a toll-free telephone number, an e-mail 
address, Web site, or postal address. 
(g) DELAY OF NOTIFICATION AUTHORIZED FOR LAW 
ENFORCEMENT PURPOSES.—If a law enforcement official 
determines that a notification, notice, or posting required 
under this section would impede a criminal investigation 
or cause damage to national security, such notification, 
notice, or posting shall be delayed in the same manner 
as provided under section 164.528(a)(2) of title 45, Code 
of Federal Regulations, in the case of a disclosure covered 
under such section. 
(h) UNSECURED PROTECTED HEALTH INFORMA-
TION.— 
(1) DEFINITION.— 
(A) IN
GENERAL.—Subject to subpara-
graph (B), for purposes of this section, the 
term ‘‘unsecured protected health information’’ 
means protected health information that is not 
secured through the use of a technology or 
methodology specified by the Secretary in the 
guidance issued under paragraph (2). 
(B) EXCEPTION
IN
CASE
TIMELY
GUID-
ANCE NOT ISSUED.—In the case that the Sec-
retary does not issue guidance under paragraph 
(2) by the date specified in such paragraph, for
583 
purposes of this section, the term ‘‘unsecured 
protected health information’’ shall mean pro-
tected health information that is not secured by 
a technology standard that renders protected 
health information unusable, unreadable, or in-
decipherable to unauthorized individuals and is 
developed or endorsed by a standards devel-
oping organization that is accredited by the 
American National Standards Institute. 
(2) GUIDANCE.—For purposes of paragraph (1) 
and section 407(f)(3), not later than the date that 
is 60 days after the date of the enactment of this 
Act, the Secretary shall, after consultation with 
stakeholders, issue (and annually update) guidance 
specifying the technologies and methodologies that 
render 
protected 
health 
information 
unusable, 
unreadable, or indecipherable to unauthorized indi-
viduals, including use of standards developed under 
section 3002(b)(2)(B)(vi) of the Public Health Serv-
ice Act, as added by section 4101. 
(i) REPORT TO CONGRESS ON BREACHES.— 
(1) IN GENERAL.—Not later than 12 months 
after the date of the enactment of this Act and an-
nually thereafter, the Secretary shall prepare and 
submit to the Committee on Finance and the Com-
584 
mittee on Health, Education, Labor, and Pensions 
of the Senate and the Committee on Ways and 
Means and the Committee on Energy and Commerce 
of the House of Representatives a report containing 
the information described in paragraph (2) regard-
ing breaches for which notice was provided to the 
Secretary under subsection (e)(3). 
(2) INFORMATION.—The information described 
in this paragraph regarding breaches specified in 
paragraph (1) shall include— 
(A) the number and nature of such 
breaches; and 
(B) actions taken in response to such 
breaches. 
(j) REGULATIONS; EFFECTIVE DATE.—To carry out 
this section, the Secretary of Health and Human Services 
shall promulgate interim final regulations by not later 
than the date that is 180 days after the date of the enact-
ment of this title. The provisions of this section shall apply 
to breaches that are discovered on or after the date that 
is 30 days after the date of publication of such interim 
final regulations.
585 
SEC. 4403. EDUCATION ON HEALTH INFORMATION PRI-
VACY. 
(a) REGIONAL OFFICE PRIVACY ADVISORS.—Not 
later than 6 months after the date of the enactment of 
this Act, the Secretary shall designate an individual in 
each regional office of the Department of Health and 
Human Services to offer guidance and education to cov-
ered entities, business associates, and individuals on their 
rights and responsibilities related to Federal privacy and 
security requirements for protected health information. 
(b) EDUCATION INITIATIVE ON USES OF HEALTH IN-
FORMATION.—Not later than 12 months after the date of 
the enactment of this Act, the Office for Civil Rights with-
in the Department of Health and Human Services shall 
develop and maintain a multi-faceted national education 
initiative to enhance public transparency regarding the 
uses of protected health information, including programs 
to educate individuals about the potential uses of their 
protected health information, the effects of such uses, and 
the rights of individuals with respect to such uses. Such 
programs shall be conducted in a variety of languages and 
present information in a clear and understandable man-
ner.
586 
SEC. 4404. APPLICATION OF PRIVACY PROVISIONS AND 
PENALTIES TO BUSINESS ASSOCIATES OF 
COVERED ENTITIES. 
(a) APPLICATION OF CONTRACT REQUIREMENTS.— 
In the case of a business associate of a covered entity that 
obtains or creates protected health information pursuant 
to a written contract (or other written arrangement) de-
scribed in section 164.502(e)(2) of title 45, Code of Fed-
eral Regulations, with such covered entity, the business 
associate may use and disclose such protected health infor-
mation only if such use or disclosure, respectively, is in 
compliance with each applicable requirement of section 
164.504(e) of such title. The additional requirements of 
this subtitle that relate to privacy and that are made ap-
plicable with respect to covered entities shall also be appli-
cable to such a business associate and shall be incor-
porated into the business associate agreement between the 
business associate and the covered entity. 
(b) APPLICATION OF KNOWLEDGE ELEMENTS ASSO-
CIATED WITH CONTRACTS.—Section 164.504(e)(1)(ii) of 
title 45, Code of Federal Regulations, shall apply to a 
business associate described in subsection (a), with respect 
to compliance with such subsection, in the same manner 
that such section applies to a covered entity, with respect 
to compliance with the standards in sections 164.502(e) 
and 164.504(e) of such title, except that in applying such
587 
section 164.504(e)(1)(ii) each reference to the business as-
sociate, with respect to a contract, shall be treated as a 
reference to the covered entity involved in such contract. 
(c) APPLICATION
OF CIVIL
AND CRIMINAL PEN-
ALTIES.—In the case of a business associate that violates 
any provision of subsection (a) or (b), the provisions of 
sections 1176 and 1177 of the Social Security Act (42 
U.S.C. 1320d–5, 1320d–6) shall apply to the business as-
sociate with respect to such violation in the same manner 
as such provisions apply to a person who violates a provi-
sion of part C of title XI of such Act. 
SEC. 4405. RESTRICTIONS ON CERTAIN DISCLOSURES AND 
SALES OF HEALTH INFORMATION; ACCOUNT-
ING OF CERTAIN PROTECTED HEALTH IN-
FORMATION DISCLOSURES; ACCESS TO CER-
TAIN INFORMATION IN ELECTRONIC FOR-
MAT. 
(a) REQUESTED RESTRICTIONS ON CERTAIN DIS-
CLOSURES OF HEALTH INFORMATION.—In the case that 
an individual requests under paragraph (a)(1)(i)(A) of 
section 164.522 of title 45, Code of Federal Regulations, 
that a covered entity restrict the disclosure of the pro-
tected health information of the individual, notwith-
standing paragraph (a)(1)(ii) of such section, the covered 
entity must comply with the requested restriction if—
588 
(1) except as otherwise required by law, the dis-
closure is to a health plan for purposes of carrying 
out payment or health care operations (and is not 
for purposes of carrying out treatment); and 
(2) the protected health information pertains 
solely to a health care item or service for which the 
health care provider involved has been paid out of 
pocket in full. 
(b) DISCLOSURES REQUIRED TO BE LIMITED TO 
THE
LIMITED
DATA
SET
OR
THE
MINIMUM
NEC-
ESSARY.— 
(1) IN GENERAL.— 
(A) IN
GENERAL.—Subject to subpara-
graph (B), a covered entity shall be treated as 
being in compliance with section 164.502(b)(1) 
of title 45, Code of Federal Regulations, with 
respect to the use, disclosure, or request of pro-
tected health information described in such sec-
tion, only if the covered entity limits such pro-
tected health information, to the extent prac-
ticable, to the limited data set (as defined in 
section 164.514(e)(2) of such title) or, if needed 
by such entity, to the minimum necessary to ac-
complish the intended purpose of such use, dis-
closure, or request, respectively.
589 
(B) 
GUIDANCE.—Not 
later 
than 
months after the date of the enactment of this 
section, the Secretary shall issue guidance on 
what constitutes ‘‘minimum necessary’’ for pur-
poses of subpart E of part 164 of title 45, Code 
of Federal Regulation. In issuing such guidance 
the Secretary shall take into consideration the 
guidance under section 4424(c). 
(C) SUNSET.—Subparagraph (A) shall not 
apply on and after the effective date on which 
the Secretary issues the guidance under sub-
paragraph (B). 
(2) 
DETERMINATION
OF
MINIMUM
NEC-
ESSARY.—For purposes of paragraph (1), in the 
case of the disclosure of protected health informa-
tion, the covered entity or business associate dis-
closing such information shall determine what con-
stitutes the minimum necessary to accomplish the 
intended purpose of such disclosure. 
(3) APPLICATION OF EXCEPTIONS.—The excep-
tions described in section 164.502(b)(2) of title 45, 
Code of Federal Regulations, shall apply to the re-
quirement under paragraph (1) as of the effective 
date described in section 4423 in the same manner
590 
that such exceptions apply to section 164.502(b)(1) 
of such title before such date. 
(4) RULE OF CONSTRUCTION.—Nothing in this 
subsection shall be construed as affecting the use, 
disclosure, or request of protected health information 
that has been de-identified. 
(c) ACCOUNTING OF CERTAIN PROTECTED HEALTH 
INFORMATION DISCLOSURES REQUIRED IF COVERED EN-
TITY USES ELECTRONIC HEALTH RECORD.— 
(1) IN GENERAL.—In applying section 164.528 
of title 45, Code of Federal Regulations, in the case 
that a covered entity uses or maintains an electronic 
health record with respect to protected health infor-
mation— 
(A) 
the 
exception 
under 
paragraph 
(a)(1)(i) of such section shall not apply to dis-
closures through an electronic health record 
made by such entity of such information; and 
(B) an individual shall have a right to re-
ceive an accounting of disclosures described in 
such paragraph of such information made by 
such covered entity during only the three years 
prior to the date on which the accounting is re-
quested.
591 
(2) REGULATIONS.—The Secretary shall pro-
mulgate regulations on what information shall be 
collected about each disclosure referred to in para-
graph (1)(A) not later than 18 months after the 
date on which the Secretary adopts standards on ac-
counting for disclosure described in the section 
3002(b)(2)(B)(iv) of the Public Health Service Act, 
as added by section 4101. Such regulations shall 
only require such information to be collected through 
an electronic health record in a manner that takes 
into account the interests of individuals in learning 
the circumstances under which their protected health 
information is being disclosed and takes into account 
the administrative burden of accounting for such 
disclosures. 
(3) CONSTRUCTION.—Nothing in this sub-
section shall be construed as requiring a covered en-
tity to account for disclosures of protected health in-
formation that are not made by such covered entity 
or by a business associate acting on behalf of the 
covered entity. 
(4) EFFECTIVE DATE.— 
(A) CURRENT
USERS
OF
ELECTRONIC 
RECORDS.—In the case of a covered entity inso-
far as it acquired an electronic health record as
592 
of January 1, 2009, paragraph (1) shall apply 
to disclosures, with respect to protected health 
information, made by the covered entity from 
such a record on and after January 1, 2014. 
(B) OTHERS.—In the case of a covered en-
tity insofar as it acquires an electronic health 
record after January 1, 2009, paragraph (1) 
shall apply to disclosures, with respect to pro-
tected health information, made by the covered 
entity from such record on and after the later 
of the following: 
(i) January 1, 2011; or 
(ii) the date that it acquires an elec-
tronic health record. 
(d) REVIEW OF HEALTH CARE OPERATIONS.—Not 
later than 18 months after the date of the enactment of 
this title, the Secretary shall promulgate regulations to 
eliminate from the definition of health care operations 
under section 164.501 of title 45, Code of Federal Regula-
tions, those activities that can reasonably and efficiently 
be conducted through the use of information that is de- 
identified (in accordance with the requirements of section 
164.514(b) of such title) or that should require a valid 
authorization for use or disclosure. In promulgating such 
regulations, the Secretary may choose to narrow or clarify
593 
activities that the Secretary chooses to retain in the defini-
tion of health care operations and the Secretary shall take 
into account the report under section 424(d). In such reg-
ulations the Secretary shall specify the date on which such 
regulations shall apply to disclosures made by a covered 
entity, but in no case would such date be sooner than the 
date that is 24 months after the date of the enactment 
of this section. 
(e) PROHIBITION ON SALE OF ELECTRONIC HEALTH 
RECORDS OR PROTECTED HEALTH INFORMATION.— 
(1) IN GENERAL.—Except as provided in para-
graph (2), a covered entity or business associate 
shall not directly or indirectly receive remuneration 
in exchange for any protected health information of 
an individual unless the covered entity obtained from 
the individual, in accordance with section 164.508 of 
title 45, Code of Federal Regulations, a valid au-
thorization that includes, in accordance with such 
section, a specification of whether the protected 
health information can be further exchanged for re-
muneration by the entity receiving protected health 
information of that individual. 
(2) EXCEPTIONS.—Paragraph (1) shall not 
apply in the following cases:
605 
‘‘(1) IN GENERAL.—A violation of a provision 
of this part due to willful neglect is a violation for 
which the Secretary is required to impose a penalty 
under subsection (a)(1). 
‘‘(2) REQUIRED INVESTIGATION.—For purposes 
of paragraph (1), the Secretary shall formally inves-
tigate any complaint of a violation of a provision of 
this part if a preliminary investigation of the facts 
of the complaint indicate such a possible violation 
due to willful neglect.’’. 
(b) EFFECTIVE DATE; REGULATIONS.— 
(1) The amendments made by subsection (a) 
shall apply to penalties imposed on or after the date 
that is 24 months after the date of the enactment 
of this title. 
(2) Not later than 18 months after the date of 
the enactment of this title, the Secretary of Health 
and Human Services shall promulgate regulations to 
implement such amendments. 
(c) DISTRIBUTION OF CERTAIN CIVIL MONETARY 
PENALTIES COLLECTED.— 
(1) IN
GENERAL.—Subject to the regulation 
promulgated pursuant to paragraph (3), any civil 
monetary penalty or monetary settlement collected 
with respect to an offense punishable under this sub-