I 
110TH CONGRESS 
2D SESSION 
H. R. 5442 
To provide individuals with access to health information of which they are 
a subject, to ensure personal privacy, security, and confidentiality with 
respect to health related information in promoting the development of 
a nationwide interoperable health information infrastructure, to impose 
criminal and civil penalties for unauthorized use of personal health infor-
mation, to provide for the strong enforcement of these rights, to protect 
States’ rights, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 14, 2008 
Mr. MARKEY (for himself, Mr. EMANUEL, and Mrs. CAPPS) introduced the fol-
lowing bill; which was referred to the Committee on Energy and Com-
merce, and in addition to the Committees on Ways and Means, Education 
and Labor, and Financial Services, for a period to be subsequently deter-
mined by the Speaker, in each case for consideration of such provisions 
as fall within the jurisdiction of the committee concerned 
A BILL 
To provide individuals with access to health information of 
which they are a subject, to ensure personal privacy, 
security, and confidentiality with respect to health related 
information in promoting the development of a nation-
wide interoperable health information infrastructure, to 
impose criminal and civil penalties for unauthorized use 
of personal health information, to provide for the strong 
enforcement of these rights, to protect States’ rights, 
and for other purposes. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Technologies for Restoring Users’ Security and Trust in 
Health Information Act of 2008’’ or as the ‘‘TRUST in 
Health Information Act of 2008’’. 
(b) TABLE OF CONTENTS.—The table of contents of 
this Act is as follows: 
Sec. 1. Short title. 
Sec. 2. Findings; purposes. 
TITLE I—HEALTH INFORMATION PRIVACY AND SECURITY 
Sec. 100. Summary of privacy rights and security obligations. 
Subtitle A—Access to and Accuracy of Personal Health Information 
Sec. 101. Inspection and copying of personal health information. 
Sec. 102. Modifications to personal health information. 
Subtitle B—Security of Personal Health Information 
Sec. 111. Notice of privacy practices. 
Sec. 112. Establishment of safeguards. 
Sec. 113. Notification in the case of breach. 
Sec. 114. Transparency. 
Sec. 115. Risk management. 
Sec. 116. Accounting for disclosures and use. 
Subtitle C—Use and Disclosure of Personal Health Information 
CHAPTER 1—GENERAL RESTRICTIONS 
Sec. 121. General rules regarding use and disclosure. 
Sec. 122. Informed consent for disclosure of personal health information for 
treatment and payment. 
Sec. 123. Informed consent and authorization for disclosure of personal health 
information other than for treatment or payment. 
CHAPTER 2—EXCEPTIONS 
Sec. 131. Disclosure for law enforcement, national security, and intelligence 
purposes. 
Sec. 132. Disclosure for public health purposes. 
Sec. 133. Reporting of abuse and neglect to protection and advocacy agencies. 
Sec. 134. Disclosure to next of kin and directory information. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6211
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
CHAPTER 3—SPECIAL CIRCUMSTANCES 
Sec. 141. Emergency circumstances. 
Sec. 142. Health research. 
Sec. 143. Health oversight functions. 
Sec. 144. Individual representatives. 
Subtitle D—Enforcement 
Sec. 151. In general. 
Sec. 152. Enforcement by State attorneys general. 
Subtitle E—Miscellaneous 
Sec. 161. Office of Health Information Privacy. 
Sec. 162. Protection for whistleblowers. 
Sec. 163. Demonstration grant for individuals with limited English language 
proficiency or limited health literacy. 
Sec. 164. Relationship to other laws. 
Sec. 165. Effective date. 
Subtitle F—General Definitions 
Sec. 171. General definitions. 
TITLE II—PROMOTION OF HEALTH INFORMATION TECHNOLOGY 
Subtitle A—Improving the Interoperability of Health Information Technology 
Sec. 201. Office of the National Coordinator of Health Information Technology. 
Sec. 202. Partnership for Health Care Improvement. 
Sec. 203. American Health Information Community policies. 
Sec. 204. Research access to health care data and reporting on performance. 
Subtitle B—Facilitating the Widespread Adoption of Interoperable Health 
Information Technology 
Sec. 211. Facilitating the widespread adoption of interoperable health informa-
tion technology. 
Sec. 212. Demonstration program to integrate information technology into clin-
ical education. 
Sec. 213. Qualified health information technology system defined. 
Subtitle C—Improving the Quality of Health Care 
Sec. 221. Fostering development and use of health care quality measures. 
Sec. 222. Adoption and use of quality measures; reporting. 
Subtitle D—Miscellaneous Provisions 
Sec. 231. Health Information Technology Resource Center. 
Sec. 232. Facilitating the provision of telehealth services across State lines. 
Subtitle E—Definitions 
Sec. 241. Definitions. 
TITLE III—ADDITIONAL PROVISIONS 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6211
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
Sec. 301. Federal purchasing and data collection by CMS and other Federal 
agencies. 
Sec. 302. Ensuring health care providers participating in the medicare program 
may maintain health information in electronic form. 
SEC. 2. FINDINGS; PURPOSES. 
(a) FINDINGS.—Congress finds the following: 
(1) Americans are deeply concerned about the 
privacy and security of their personal information, 
including their health records. 
(2) In October 2007, a Harris Interactive Poll 
commissioned by the Institute of Medicine found 
that 58 percent of respondents indicated they do not 
believe Federal and State laws and organizational 
practices offer sufficient protection of personal 
health information. 
(3) In February 2007, the Markle Foundation 
reported that 80 percent of individuals surveyed 
were very concerned about identity theft or fraud 
and 77 percent were very concerned that their med-
ical information would be used for marketing pur-
poses. 
(4) Concerns about the privacy and security of 
personal health information are fueled by the esca-
lating number of breaches of personal information 
that have occurred in recent years and numerous re-
ports of the inadequacy of the security of electronic 
networks. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(5) According to the Privacy Rights Clearing-
house, more than 216,000,000 data records belong-
ing to U.S. residents have been exposed to potential 
misuse as a result of security breaches since Janu-
ary 2005. 
(6) A nationwide interoperable health informa-
tion infrastructure can strengthen privacy, security, 
and confidentiality safeguards, protecting patients’ 
personal health information while also improving 
health care quality, safety, and affordability. 
(7) In order for individuals, health care pro-
viders, and health care payers to achieve the benefits 
associated with such infrastructure, strong data pri-
vacy, security, and confidentiality standards must be 
developed, adopted, and incorporated into the health 
information technology infrastructure. 
(8) While Executive Order 13335 regarding 
interoperable health information technology issued 
on April 27, 2004, called for widespread adoption of 
interoperable electronic health records within 10 
years, established the position of National Coordi-
nator of Health Information Technology, and stipu-
lated that the plan for the nationwide implementa-
tion of interoperable health information technology 
should address privacy and security issues, adequate 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
progress has not been made to ensure that a strong 
data privacy, security, and confidentiality approach 
will guide the development of this nationwide infra-
structure beginning in its initial stages and con-
tinuing throughout its formulation. 
(9) According to a February 1, 2007, report of 
the Government Accountability Office (GAO), the 
Department of Health and Human Services and its 
Office of the National Coordinator of Health Infor-
mation Technology have not yet defined an overall 
approach for integrating privacy-related initiatives 
the Department has undertaken in the area of 
health information technology or addressing key pri-
vacy principles, nor has the Department defined 
milestones for integrating the results of these activi-
ties while it has moved forward with development of 
standards for a national electronic health informa-
tion system. 
(10) All Americans have a right to privacy, se-
curity, and confidentiality with respect to the elec-
tronic disclosure of their personal health informa-
tion, and the nationwide implementation of inter-
operable health information technology should abide 
by, and be consistent with, this right. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(11) Without adequate privacy, security, and 
confidentiality standards, individuals will be more 
likely to avoid or delay medical treatment or with-
hold pertinent information from their health pro-
viders, potentially resulting in lost productivity, in-
creased morbidity rates, and increased costs to the 
health care system. 
(12) As stipulated by the Secretary of Health 
and Human Services in the Final Rule for Stand-
ards for Privacy of Individually Identifiable Health 
Information (45 C.F.R. parts 160 and 164), the 
standards contained in the Final Rule are intended 
to establish a floor of privacy protection and are not 
designed to serve as ‘‘best practices’’ for the use or 
disclosure of personal health information. 
(13) To guide the development, implementation, 
and operation of an interoperable nationwide health 
information technology infrastructure, Congress 
should establish specific minimum standards for the 
use and disclosure of individuals’ personal health in-
formation and direct the Department of Health and 
Human Services to promulgate regulations relating 
to personal health information that are consistent 
with individuals’ right to privacy, security, and con-
fidentiality with respect to the electronic use or dis-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
closure of their personal health information, the 
public interest, and the purposes of this Act. 
(b) PURPOSE.—The purposes of this Act are as fol-
lows: 
(1) To recognize that individuals have a right 
to privacy, confidentiality, and security with respect 
to health information, including genetic information, 
and that those fundamental rights are rooted in the 
Nation’s history and medical ethics and must be 
protected. 
(2) To ensure that individuals are able to exer-
cise their right to health information privacy by re-
quiring their consent for the use and disclosure of 
their identifiable health information unless otherwise 
required by law. 
(3) To encourage the development of a nation-
wide interoperable health information technology in-
frastructure that protects individuals’ privacy, con-
fidentiality, and security with respect to their health 
information while also improving health care quality, 
promoting data accuracy, reducing medical errors, 
and increasing the efficiency of care. 
(4) To create incentives to turn personal health 
information into de-identified health information (as 
defined in section 171(5)), where appropriate. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(5) To designate an Office of Health Informa-
tion Privacy within the Department of Health and 
Human Services to protect individuals’ right of pri-
vacy. 
(6) To provide individuals with— 
(A) access to health information of which 
they are the subject; 
(B) the opportunity to challenge the accu-
racy and completeness of such information by 
being able to file modifications to or request the 
deletion of such information; and 
(C) the right to limit the use and disclo-
sure of personal health information. 
(7) To establish strong and effective mecha-
nisms to protect against the unauthorized and inap-
propriate use of personal health information and en-
sure that these mechanisms safeguard this informa-
tion wherever it may reside. 
(8) To provide notice to individuals of breaches 
of their personal health information. 
(9) To invoke the sweep of congressional pow-
ers, including the power to enforce the 14th Amend-
ment to the Constitution, to regulate commerce, and 
to abrogate the immunity of the States under the 
11th Amendment to the Constitution, in order to ad-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
dress violations of the rights of individuals to pri-
vacy, to provide individuals with access to their 
health information, and to prevent the unauthorized 
use of personal health information that is genetic in-
formation. 
(10) To establish strong and effective remedies 
for violations of this Act. 
(11) To protect the rights of States. 
TITLE I—HEALTH INFORMATION 
PRIVACY AND SECURITY 
SEC. 100. SUMMARY OF PRIVACY RIGHTS AND SECURITY 
OBLIGATIONS. 
(a) PRIVACY RIGHTS.—In order to provide individ-
uals who are the subject of personal health information 
with privacy, security, and control in the use and disclo-
sure of such information, such individuals are provided the 
following rights under this title: 
(1) The right to not have their personal health 
information disclosed without their informed consent 
unless otherwise required by law, pursuant to sub-
title C. 
(2) The right to inspect and copy their personal 
health information, pursuant to section 101. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(3) The right to correct, supplement, or remove 
their personal information held by a person, pursu-
ant to section 102. 
(4) The right to prohibit access by certain cat-
egories of persons to particularly sensitive personal 
health information about individuals, such as infor-
mation relating to mental health, domestic violence, 
sexually transmitted diseases, and infection with the 
human immunodeficiency virus (HIV), pursuant to 
section 122. 
(5) The right to receive notification of actual or 
suspected security breaches of their personal health 
information, pursuant to section 113. 
(6) The right to receive an accounting of all 
electronic disclosures of their personal health infor-
mation upon request, pursuant to section 116. 
(b) SECURITY OBLIGATIONS.—A person that dis-
closes, uses, or receives an individual’s personal health in-
formation has obligations under this title, including the 
following: 
(1) The obligation to expressly recognize the 
right to privacy and security of such individual with 
respect to the use and disclosure of such information 
under subtitle B. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(1) IN GENERAL.—A health information person 
(as defined in section 171(13)) shall permit an indi-
vidual who is the subject of personal health informa-
tion (as defined in section 171(23)) that the person 
holds, uses, or discloses, or the individual’s designee, 
to inspect and copy the personal health information 
concerning the individual. 
(2) PROCEDURES AND FEES.—A health infor-
mation person may establish appropriate procedures 
to be followed for inspection and copying under 
paragraph (1) and may require an individual to pay 
reasonable fees associated with such inspection and 
copying in an amount that is not in excess of the ac-
tual costs of providing such copying. Such fees may 
not be assessed where such an assessment would 
have the effect of inhibiting an individual from gain-
ing access to the information described in paragraph 
(1). 
(b) DEADLINE.—A health information person shall 
comply with a request for inspection or copying of personal 
health information under this section not later than— 
(1) 15 business days after the date on which 
the person receives the request, if such request re-
quires the inspection, copying, or sending of printed 
materials; or 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(2) 5 business days after the date on which the 
person receives the request, or sooner if the Sec-
retary determines appropriate, if such request re-
quires only the inspection, copying, or sending of 
electronic or other digital materials. 
(c) RULES GOVERNING AGENTS.—A person that is 
the agent, officer, or employee of a health information per-
son shall provide for the inspection and copying of per-
sonal health information if— 
(1) the personal health information is retained 
by the person; and 
(2) the person has been asked by the health in-
formation person to fulfill the requirements of this 
section. 
(d) SPECIAL RULE RELATING TO ONGOING CLINICAL 
TRIALS.—With respect to personal health information 
that is created as part of an individual’s voluntary partici-
pation in an ongoing clinical trial, access to the informa-
tion shall be provided within 15 business days after the 
date on which the health information person receives the 
request or consistent with the individual’s agreement to 
participate in the clinical trial, whichever is sooner. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
SEC. 102. MODIFICATIONS TO PERSONAL HEALTH INFOR-
MATION. 
(a) IN GENERAL.—Not later than 15 business days, 
or earlier if the Secretary determines appropriate, after 
the date on which a health information person receives 
from an individual a request in writing to supplement, cor-
rect, amend, segregate, or remove personal health infor-
mation that the person holds, uses, or discloses concerning 
the individual, such person— 
(1) shall, subject to subsections (b) and (c), 
modify the information, by adding the requested 
supplement, correction, or amendment to the infor-
mation, or by removing any information that has 
been requested to be destroyed; 
(2) shall inform the individual that the modi-
fication has been made; and 
(3) shall make reasonable efforts to inform any 
person to which the portion of the unmodified infor-
mation was previously disclosed, of any substantive 
modification that has been made. 
(b) REFUSAL TO MODIFY.—If a health information 
person declines to make the modification requested under 
subsection (a) within 15 business days after receipt of 
such request, such person shall inform the individual in 
writing of— 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(1) the reasons for declining to make the modi-
fication; 
(2) any procedures for further review of the de-
clining of such modification; and 
(3) the individual’s right to file with the person 
a concise statement setting forth the requested 
modification and the individual’s reasons for dis-
agreeing with the declining person and the individ-
ual’s right to include a copy of this refusal in the 
health record set (as defined in section 171(17)) 
concerning the individual. 
(c) STATEMENT
OF DISAGREEMENT.—If an indi-
vidual has filed with a health information person a state-
ment of disagreement under subsection (b)(3), the person, 
in any subsequent disclosure of the disputed portion of 
the information— 
(1) shall include, at the individual’s request, a 
copy of the individual’s statement in the individual’s 
health record set; and 
(2) may include a concise statement of the rea-
sons for not making the requested modification. 
(d) RULES GOVERNING AGENTS.—A person that is 
the agent of a health information person shall only be re-
quired to make a modification to personal health informa-
tion where— 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(1) the personal health information is retained, 
distributed, used, or maintained by the agent; and 
(2) the agent has been asked by such person to 
fulfill the requirements of this section. 
Subtitle B—Security of Personal 
Health Information 
SEC. 111. NOTICE OF PRIVACY PRACTICES. 
(a) PREPARATION OF WRITTEN NOTICE.—A health 
information person shall prepare a written notice of the 
privacy practices of such person, including information 
with respect to the following: 
(1) The express right of an individual to pri-
vacy, security, and confidentiality with respect to the 
disclosure of such individual’s personal health infor-
mation. 
(2) The procedures for an individual to exercise 
that right by authorizing disclosures of personal 
health information, and to object to, modify, and re-
voke such authorizations. 
(3) The right of an individual to inspect, copy, 
and modify that individual’s personal health infor-
mation. 
(4) The right of an individual not to have em-
ployment or the receipt of services or choice of 
health plan conditioned upon the execution by the 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
individual of an authorization for disclosure, except 
as permitted by section 122(c). 
(5) A description of— 
(A) the categories or types of employees, 
by general category or by general job descrip-
tion, who have access to or use of personal 
health information regarding the individual; 
(B) the right of the individual to limit ac-
cess to or use of his or her personal health in-
formation by employees, agents, and contractors 
of the person; and 
(C) the procedures for effecting such limi-
tations. 
(6) A simple, concise description of any infor-
mation systems used to store or transmit personal 
health information, including a description of any 
linkages made with other networks, systems, or 
databases outside the person’s direct control. 
(7) The circumstances under which the infor-
mation will be, lawfully and actually, used or dis-
closed without an authorization executed by the indi-
vidual. 
(8) A statement that, if an individual elects to 
pay for health care from the individual’s own funds, 
that individual may elect for personal health infor-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
mation, including any identifying information, not to 
be disclosed to anyone other than designated health 
care providers, unless such disclosure is required by 
mandatory reporting requirements or other similar 
information collection duties required by law. 
(9) The right of the individual to have contin-
ued maintenance, distribution, or storage of that in-
dividual’s personal health information not condi-
tioned upon whether that individual amends or re-
vokes an authorization for disclosure, or requests a 
modification of personal health information. 
(10) The right of and procedures for an indi-
vidual to request that personal health information be 
transferred to a third party person without unrea-
sonable delay. 
(11) The right to prompt notification of an ac-
tual or suspected security breach of personal health 
information, and how such breaches will be remedied 
by the person. 
(12) The right of an individual to inspect and 
obtain a copy of records of authorized and unauthor-
ized disclosures as well as attempted and actual ac-
cess and use by an authorized or unauthorized per-
son. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(13) The right of an individual to exercise non-
disclosure and nonuse rights with respect to their 
personal health information, including the right to 
opt out of any local, regional, or nationwide health 
information network or system that is used by the 
person. 
(b) PROVISION
AND POSTING
OF WRITTEN NO-
TICE.— 
(1) PROVISION.—A health information person 
shall provide in writing a copy of the notice of pri-
vacy practices required under subsection (a)— 
(A) at the first contact between the indi-
vidual and the person; and 
(B) upon the request of an individual. 
(2) POSTING.—A health information person 
shall post, in a clear and conspicuous manner, a 
brief summary of the privacy practices of the person. 
(c) MODEL NOTICE.—The Secretary, in consultation 
with the Director of the Office of Health Information Pri-
vacy, after notice and opportunity for public comment, 
shall develop and disseminate model notices of privacy 
practices, and model summary notices for posting for use 
under this section. Use of such model notice shall be 
deemed to satisfy the requirements of this section. 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
SEC. 112. ESTABLISHMENT OF SAFEGUARDS. 
(a) IN GENERAL.—A health information person 
shall— 
(1) establish and maintain appropriate adminis-
trative, organizational, technical, and physical safe-
guards and procedures to ensure the privacy, con-
fidentiality, security, accuracy, and integrity of per-
sonal health information that is accessed, main-
tained, retained, modified, recorded, stored, de-
stroyed, or otherwise held, used, or disclosed by such 
person; and 
(2) employ an individual whose responsibilities 
include the management of the person’s information 
security. 
(b) FACTORS TO BE CONSIDERED.—The policies and 
safeguards established under subsection (a) shall ensure 
that— 
(1) personal health information is used or dis-
closed only with informed consent (as defined in sec-
tion 171(19)); 
(2) the categories of personnel who will, with 
the informed consent of the individual, have access 
to personal health information are identified; 
(3) the feasibility of limiting access to personal 
health information is considered; 
VerDate Aug 31 2005 
00:08 Feb 22, 2008
Jkt 069200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(4) the privacy, security, and confidentiality of 
personal health information is maintained; 
(5) personal health information is protected 
against any reasonably anticipated vulnerabilities to 
the privacy, security, or integrity of such informa-
tion; and 
(6) personal health information is protected 
against unauthorized access, use, or misuse of such 
information. 
(c) MODEL GUIDELINES.—The Secretary, in con-
sultation with the Director of the Office of Health Infor-
mation Privacy appointed under section 161, after notice 
and opportunity for public comment, in accordance with 
the requirements of chapter 5 of title 5, United States 
Code, shall develop and disseminate model guidelines for 
the establishment of safeguards and procedures for use 
under this section, such as, where appropriate, individual 
authentication of uses of computer systems, access con-
trols, audit trails, encryption or any additional security 
methodology or technology other than encryption which 
renders data in electronic form unreadable or indecipher-
able, physical security, protection of remote access points 
and protection of external electronic communications, peri-
odic security assessments, incident reports, and sanctions. 
The Secretary, in consultation with the Director, shall up-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
date and disseminate the guidelines, as appropriate, to 
take advantage of new technologies, so as to ensure that 
the guidelines emphasize the need for stringent privacy, 
security, and confidentiality safeguards and procedures. 
(d) REVIEW AND UPDATING OF SAFEGUARDS.—Per-
sons subject to this title shall monitor, evaluate, and ad-
just, as appropriate, all safeguards and procedures, con-
comitant with relevant changes in technology, the sensi-
tivity of personally identifiable information, internal or ex-
ternal threats to personally identifiable information, and 
any changes in the contracts or business of the person. 
For the purpose of reviewing and updating safeguards, the 
Secretary may provide technical assistance to health infor-
mation persons, as appropriate. 
SEC. 113. NOTIFICATION IN THE CASE OF BREACH. 
(a) IN GENERAL.—A health information person that 
accesses, maintains, retains, modifies, records, stores, de-
stroys, or otherwise holds, uses, or discloses personal 
health information shall, following the discovery of a secu-
rity breach (as defined in section 171(28)) of such infor-
mation, notify each individual whose personal health infor-
mation has been, or is reasonably believed to have been, 
accessed, or acquired during such breach. 
(b) OBLIGATION OF OWNER OR LICENSEE.— 
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS
(1) NOTICE
TO
OWNER
OR
LICENSEE.—Any 
person engaged in interstate commerce, that uses, 
accesses, transmits, stores, disposes of, or collects 
personal health information that the person does not 
own or license shall notify the owner or licensee of 
the information following the discovery of a security 
breach involving such information. 
(2) NOTICE BY OWNER, LICENSEE, OR OTHER 
DESIGNATED THIRD PARTY.—Nothing in this sub-
title shall be construed to prevent or abrogate an 
agreement between a person required to give notice 
under this section and a designated third party, in-
cluding an owner or licensee of the personal health 
information subject to the security breach, to pro-
vide the notifications required under subsection (a). 
(3) PERSON RELIEVED FROM GIVING NOTICE.— 
A person obligated to give notice under subsection 
(a) shall be relieved of such obligation if an owner 
or licensee of the personal health information subject 
to the security breach, or other designated third 
party, provides such notification. 
(c) TIMELINESS OF NOTIFICATION.— 
(1) IN
GENERAL.—All notifications required 
under this section shall be made within 15 business 
days, or earlier if the Secretary determines appro-
VerDate Aug 31 2005 
20:42 Feb 21, 2008
Jkt 069200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H5442.IH
H5442
hsrobinson on PROD1PC76 with BILLS