by an equivalent accreditation program determined 
appropriate by the Secretary. 
‘‘(3) ENHANCING
TREATMENT, QUALITY
IM-
PROVEMENT, RESEARCH, PUBLIC HEALTH EFFORTS 
AND OTHER FUNCTIONS.— 
‘‘(A) EQUIVALENT AUTHORITY TO OTHER 
COVERED ENTITIES.—Subject to paragraph (2), 
a health care clearinghouse shall— 
‘‘(i) in addition to carrying out claims 
processing functions, be permitted to use 
and disclose protected health information 
without obtaining individual authorization 
to the same extent as other covered enti-
ties, including for purposes of treatment, 
payment, health care operations as per-
mitted by section 164.506 of title 45, Code 
of Federal Regulations, research, and pub-
lic health as permitted by section 164.512 
of title 45, Code of Federal Regulations, 
and creating de-identified information as 
permitted by section 164.502(d) of title 
45, Code of Federal Regulations; and 
‘‘(ii) use or disclose protected health 
information 
as 
required 
by 
section 
VerDate Sep 11 2014 
03:23 Dec 14, 2017
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4613.IH
H4613
SSpencer on DSKBBV9HB2PROD with BILLS
164.502(a)(2) of title 45, Code of Federal 
Regulations. 
‘‘(B) ADDITIONAL AUTHORITY.— 
‘‘(i) A health care clearinghouse shall 
be permitted to provide an individual or 
the personal representative of such indi-
vidual access to the protected health infor-
mation of such individual as described in 
subsection (d). 
‘‘(ii) All covered entities, including a 
health care clearinghouse, shall, subject to 
subsection (c)(2), be permitted to— 
‘‘(I) on behalf of covered entities, 
use and disclose protected health in-
formation for health care operations 
purposes 
(as 
defined 
by 
section 
164.501 of title 45, Code of Federal 
Regulations) 
without 
respect 
to 
whether the recipient of the informa-
tion has or had a relationship with the 
individual; 
‘‘(II) upon the request of a cov-
ered entity, benchmark (as defined by 
the Secretary pursuant to rulemaking) 
the operations of such covered entity 
VerDate Sep 11 2014 
03:23 Dec 14, 2017
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4613.IH
H4613
SSpencer on DSKBBV9HB2PROD with BILLS
against the operations of one or more 
other covered entities that have elect-
ed to participate in such benchmark-
ing; and 
‘‘(III) use and disclose protected 
health information to facilitate clinical 
trial recruitment, except that in the 
case the covered entity provides a con-
sumer-facing portal or website that in-
forms individuals of clinical trials con-
ducted by the covered entity, the cov-
ered entity shall secure opt-in consent 
from the individual, or the individual’s 
personal representative, prior to con-
tacting an individual regarding such 
clinical trials unless such covered enti-
ty already has a relationship with the 
individual. 
‘‘(C) CLARIFICATION.—Nothing in this 
paragraph shall expand the authority of a 
health care clearinghouse or any other covered 
entity to use or disclose protected health infor-
mation for marketing purposes under sections 
164.501 and 164.508(a)(3) of title 45, Code of 
Federal Regulations. 
VerDate Sep 11 2014 
22:56 Dec 14, 2017
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4613.IH
H4613
SSpencer on DSKBBV9HB2PROD with BILLS
‘‘(c) AUTHORITIES
RELATING
TO
DATA
PROC-
ESSING.— 
‘‘(1) IN GENERAL.—In carrying out HIPAA-re-
lated provisions, the Secretary shall permit a health 
care clearinghouse to aggregate protected health in-
formation, within the clearinghouse and among other 
clearinghouses, that the clearinghouse possesses in 
order to carry out the functions described in sub-
section (b)(3). Subject to section 164.502(a)(5)(i) of 
title 45, Code of Federal Regulations, a health care 
clearinghouse may carry out the functions described 
in subsection (b)(3) without obtaining individual au-
thorization under section 164.508 of title 45, Code 
of Federal Regulations. 
‘‘(2) PRIVACY.—For purposes of clauses (ii) 
through (iv) of subsection (b)(3)(B), with respect to 
any report, analysis, or presentation provided by the 
covered entity to a third party, such report, analysis, 
or presentation— 
‘‘(A) shall include only de-identified data; 
or 
‘‘(B) shall include, subject to a qualifying 
data use agreement (as defined in subsection 
(j)), protected health information. 
‘‘(3) CLARIFICATION; FEE PERMITTED.— 
VerDate Sep 11 2014 
03:23 Dec 14, 2017
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4613.IH
H4613
SSpencer on DSKBBV9HB2PROD with BILLS
‘‘(A) IN GENERAL.—Nothing in this para-
graph shall be construed as affecting an individ-
ual’s right to access claims and payment 
records in HIPAA standard format, in accord-
ance with section 164.524 of title 45, Code of 
Federal Regulations. 
‘‘(B) FEE PERMITTED.—If an individual 
or a personal representative of the individual 
requests a copy of records in HIPAA standard 
format a health care clearinghouse may charge 
a reasonable, cost-based fee so far as such fee 
is in accordance with section 164.524(c)(4) of 
title 45, Code of Federal Regulations. 
‘‘(d) COMPREHENSIVE RECORDS AT THE REQUEST 
OF AN INDIVIDUAL.— 
‘‘(1) IN GENERAL.—When a health care clear-
inghouse receives a written request from an indi-
vidual or the personal representative of the indi-
vidual for the protected health information of the in-
dividual, the clearinghouse shall provide to the indi-
vidual a comprehensive record of such information 
(across health care providers and health plans and 
longitudinal in scope), unless the clearinghouse de-
termines in its sole discretion that providing a com-
prehensive record is not technologically feasible. 
VerDate Sep 11 2014 
03:23 Dec 14, 2017
Jkt 079200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4613.IH
H4613
SSpencer on DSKBBV9HB2PROD with BILLS
‘‘(2) PURCHASE
FROM
OTHER
CLEARING-
HOUSES.—In preparing a comprehensive record for 
an individual under paragraph (1), a health care 
clearinghouse may, with the permission of the indi-
vidual, purchase the protected health information of 
the individual from one or more other health clear-
inghouses (and the amount of such purchase may be 
included in a fee that is fair market value, as de-
fined in subsection (j)(2), charged to the individual. 
‘‘(e) SITUATIONS NOT INVOLVING DIRECT INTER-
ACTION WITH INDIVIDUALS.—Sections 164.400 through 
164.414 (relating to breach notification) and sections 
164.520 through 164.528 (relating to individual rights) 
of title 45, Code of Federal Regulations, shall apply to 
a health care clearinghouse that engages in the functions 
described in subsection (b)(3) to the extent that such 
clearinghouse has current contact information pursuant to 
direct interaction with the individual involved. If the clear-
inghouse does not have direct interaction with the indi-
vidual involved, the clearinghouse shall provide notice of 
any breach of unsecured protected health information to 
the covered entity that does have direct interaction with 
the individual involved. The clearinghouse shall not be re-
quired to report a breach if the protected health informa-
tion is rendered unusable, unreadable, or indecipherable 
VerDate Sep 11 2014 
03:23 Dec 14, 2017
Jkt 079200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4613.IH
H4613
SSpencer on DSKBBV9HB2PROD with BILLS
to unauthorized persons through the use of a technology 
or methodology specified by the Secretary in the guidance 
issued under section 13402(h)(2). The clearinghouse shall 
also provide a notice of privacy practices on its website. 
‘‘(f) TRANSITION.— 
‘‘(1) IN GENERAL.—Except where specifically 
stated, nothing in this section shall be construed to 
apply to clearinghouses to the exclusion of other cov-
ered entities or to provide a health care clearing-
house greater authority to use and disclose protected 
health information than that provided to another 
covered entity. 
‘‘(2) EXISTING AGREEMENTS.—With respect to 
agreements entered into by a health care clearing-
house prior to the date of enactment of this section, 
a provision of such an agreement that conflicts with 
this section shall not have any legal force or effect. 
The preceding sentence may not be construed as af-
fecting any provision of an agreement that does not 
conflict with this section. 
‘‘(g) SAFE HARBOR AND CLARIFICATION OF LIABIL-
ITY.—In the case of a health care clearinghouse that en-
gages in a function described in subsection (b), only that 
clearinghouse may be held liable for a violation of a 
HIPAA-related provision (and a covered entity that pro-
VerDate Sep 11 2014 
03:23 Dec 14, 2017
Jkt 079200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4613.IH
H4613
SSpencer on DSKBBV9HB2PROD with BILLS
vided data or data access to the clearinghouse shall not 
be liable for such violations). 
‘‘(h) ENFORCEMENT.—Section 13410(a)(2) shall 
apply to this section in the same manner as such section 
applies to parts 1 and 2. 
‘‘(i) RELATION TO OTHER LAWS.— 
‘‘(1) APPLICATION OF HITECH RULE.—Section 
13421 shall apply to this section in the same man-
ner as such section applies to parts 1 and 2, except 
to the extent that such section 13421 concerns sec-
tion 1178(a)(2)(B) of the Social Security Act. 
‘‘(2) STATE LAWS REGARDING UNFAIR OR DE-
CEPTIVE ACTS OR PRACTICES.—This part shall not 
be construed to preempt the law of any State that 
prohibits unfair or deceptive acts or practices or 
limit the authority of State attorneys general to en-
force such laws. 
‘‘(j) DEFINITIONS.—In this part: 
‘‘(1) DE-IDENTIFIED.—The term ‘de-identified’, 
with respect to health information, means such in-
formation that is not individually identifiable as de-
termined in accordance with the standards under 
section 164.514(b) of title 45, Code of Federal Reg-
ulations. 
VerDate Sep 11 2014 
03:23 Dec 14, 2017
Jkt 079200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4613.IH
H4613
SSpencer on DSKBBV9HB2PROD with BILLS
‘‘(2) FAIR
MARKET
VALUE.—The term ‘fair 
market value’ means the price that a person reason-
ably knowledgeable and interested in buying a given 
product or service would pay to a person reasonably 
knowledgeable and interested in selling the product 
or service. 
‘‘(3) HEALTH
CARE
CLEARINGHOUSE.—The 
term ‘health care clearinghouse’ has the meaning 
given such term in section 1171 of the Social Secu-
rity Act. 
‘‘(4) HIPAA-RELATED PROVISION.—The term 
‘HIPAA-related provision’ means the provisions of 
each of the following: 
‘‘(A) This subtitle. 
‘‘(B) Part C of title XI of the Social Secu-
rity Act. 
‘‘(C) Regulations promulgated pursuant to 
sections 262(a) and 264(c) of the Health Insur-
ance Portability and Accountability Act of 1996 
or this subtitle. 
‘‘(5) INDIVIDUAL.—The term ‘individual’, with 
respect to protected health information, has the 
meaning applicable under section 160.103 of title 
45, Code of Federal Regulations. 
VerDate Sep 11 2014 
03:23 Dec 14, 2017
Jkt 079200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4613.IH
H4613
SSpencer on DSKBBV9HB2PROD with BILLS
‘‘(6) QUALIFYING DATA USE AGREEMENT.—The 
term ‘qualifying data use agreement’ means an 
agreement, which may be electronic, that— 
‘‘(A) establishes the permitted uses and 
disclosures of protected health information by 
the recipient; 
‘‘(B) limits such uses and disclosures to 
the original purpose of disclosure under sub-
section (b)(3)(B); and 
‘‘(C) provides that the data recipient will— 
‘‘(i) not use or further disclose the in-
formation other than as permitted by the 
qualifying data use agreement or as other-
wise required by law; 
‘‘(ii) use appropriate safeguards to 
prevent use or disclosure of the informa-
tion other than as provided for by the 
qualifying data use agreement; and 
‘‘(iii) ensure that any agents to whom 
it provides the data agree to the same re-
strictions and conditions that apply to the 
data recipient with respect to such infor-
mation.’’. 
(b) REGULATIONS.—Not later than 180 days after 
the date of the enactment of this Act, the Secretary of 
VerDate Sep 11 2014 
03:23 Dec 14, 2017
Jkt 079200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H4613.IH
H4613
SSpencer on DSKBBV9HB2PROD with BILLS
Health and Human Services shall promulgate regulations 
to carry out the amendment made by subsection (a). 
(c) CONFORMING AMENDMENT.—Section 1171(2) of 
the Social Security Act (42 U.S.C. 1320d(2)) is amended 
by inserting before the period the following: ‘‘or receives 
a standard transaction from another entity and processes 
or facilitates the processing of health information into 
nonstandard format or nonstandard data content for the 
receiving entity. Such term also includes an entity that 
carries out such processing functions, transmits standard 
health care claims, transmits health care claim payments 
or provides advice on such, and transmits any standard 
transactions on behalf of a HIPAA-covered entity and in 
addition, engages in any authority of such entity described 
in subsection (b)(3) of section 13451 of the Health Infor-
mation Technology for Economic and Clinical Health 
Act’’. 
Æ 
VerDate Sep 11 2014 
03:23 Dec 14, 2017
Jkt 079200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6301
E:\BILLS\H4613.IH
H4613
SSpencer on DSKBBV9HB2PROD with BILLS