276 
(11) PERSONAL HEALTH RECORD.—The term 
‘‘personal health record’’ means an electronic record 
of individually identifiable health information on an 
individual that can be drawn from multiple sources 
and that is managed, shared, and controlled by or 
for the individual. 
(12) PROTECTED HEALTH INFORMATION.—The 
term ‘‘protected health information’’ has the mean-
ing given such term in section 160.103 of title 45, 
Code of Federal Regulations. 
(13) 
SECRETARY.—The 
term 
‘‘Secretary’’ 
means the Secretary of Health and Human Services. 
(14) SECURITY.—The term ‘‘security’’ has the 
meaning given such term in section 164.304 of title 
45, Code of Federal Regulations. 
(15) STATE.—The term ‘‘State’’ means each of 
the several States, the District of Columbia, Puerto 
Rico, the Virgin Islands, Guam, American Samoa, 
and the Northern Mariana Islands. 
(16) TREATMENT.—The term ‘‘treatment’’ has 
the meaning given such term in section 164.501 of 
title 45, Code of Federal Regulations. 
(17) USE.—The term ‘‘use’’ has the meaning 
given such term in section 160.103 of title 45, Code 
of Federal Regulations. 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00276
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
277 
(18) 
VENDOR
OF
PERSONAL
HEALTH 
RECORDS.—The term ‘‘vendor of personal health 
records’’ means an entity, other than a covered enti-
ty (as defined in paragraph (3)), that offers or 
maintains a personal health record. 
PART I—IMPROVED PRIVACY PROVISIONS AND 
SECURITY PROVISIONS 
SEC. 4401. APPLICATION OF SECURITY PROVISIONS AND 
PENALTIES TO BUSINESS ASSOCIATES OF 
COVERED ENTITIES; ANNUAL GUIDANCE ON 
SECURITY PROVISIONS. 
(a) APPLICATION OF SECURITY PROVISIONS.—Sec-
tions 164.308, 164.310, 164.312, and 164.316 of title 45, 
Code of Federal Regulations, shall apply to a business as-
sociate of a covered entity in the same manner that such 
sections apply to the covered entity. The additional re-
quirements of this title that relate to security and that 
are made applicable with respect to covered entities shall 
also be applicable to such a business associate and shall 
be incorporated into the business associate agreement be-
tween the business associate and the covered entity. 
(b) APPLICATION
OF CIVIL
AND CRIMINAL PEN-
ALTIES.—In the case of a business associate that violates 
any security provision specified in subsection (a), sections 
1176 and 1177 of the Social Security Act (42 U.S.C. 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00277
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
278 
1320d–5, 1320d–6) shall apply to the business associate 
with respect to such violation in the same manner such 
sections apply to a covered entity that violates such secu-
rity provision. 
(c) ANNUAL GUIDANCE.—For the first year begin-
ning after the date of the enactment of this Act and annu-
ally thereafter, the Secretary of Health and Human Serv-
ices shall, in consultation with industry stakeholders, an-
nually issue guidance on the most effective and appro-
priate technical safeguards for use in carrying out the sec-
tions referred to in subsection (a) and the security stand-
ards in subpart C of part 164 of title 45, Code of Federal 
Regulations, as such provisions are in effect as of the date 
before the enactment of this Act. 
SEC. 4402. NOTIFICATION IN THE CASE OF BREACH. 
(a) IN GENERAL.—A covered entity that accesses, 
maintains, retains, modifies, records, stores, destroys, or 
otherwise holds, uses, or discloses unsecured protected 
health information (as defined in subsection (h)(1)) shall, 
in the case of a breach of such information that is discov-
ered by the covered entity, notify each individual whose 
unsecured protected health information has been, or is 
reasonably believed by the covered entity to have been, 
accessed, acquired, or disclosed as a result of such breach. 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00278
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
279 
(b) NOTIFICATION OF COVERED ENTITY BY BUSI-
NESS ASSOCIATE.—A business associate of a covered enti-
ty that accesses, maintains, retains, modifies, records, 
stores, destroys, or otherwise holds, uses, or discloses un-
secured protected health information shall, following the 
discovery of a breach of such information, notify the cov-
ered entity of such breach. Such notice shall include the 
identification of each individual whose unsecured protected 
health information has been, or is reasonably believed by 
the business associate to have been, accessed, acquired, 
or disclosed during such breach. 
(c) BREACHES TREATED AS DISCOVERED.—For pur-
poses of this section, a breach shall be treated as discov-
ered by a covered entity or by a business associate as of 
the first day on which such breach is known to such entity 
or associate, respectively, (including any person, other 
than the individual committing the breach, that is an em-
ployee, officer, or other agent of such entity or associate, 
respectively) or should reasonably have been known to 
such entity or associate (or person) to have occurred. 
(d) TIMELINESS OF NOTIFICATION.— 
(1) IN GENERAL.—Subject to subsection (g), all 
notifications required under this section shall be 
made without unreasonable delay and in no case 
later than 60 calendar days after the discovery of a 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00279
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
280 
breach by the covered entity involved (or business 
associate involved in the case of a notification re-
quired under subsection (b)). 
(2) BURDEN OF PROOF.—The covered entity in-
volved (or business associate involved in the case of 
a notification required under subsection (b)), shall 
have the burden of demonstrating that all notifica-
tions were made as required under this part, includ-
ing evidence demonstrating the necessity of any 
delay. 
(e) METHODS OF NOTICE.— 
(1) 
INDIVIDUAL
NOTICE.—Notice 
required 
under this section to be provided to an individual, 
with respect to a breach, shall be provided promptly 
and in the following form: 
(A) Written notification by first-class mail 
to the individual (or the next of kin of the indi-
vidual if the individual is deceased) at the last 
known address of the individual or the next of 
kin, respectively, or, if specified as a preference 
by the individual, by electronic mail. The notifi-
cation may be provided in one or more mailings 
as information is available. 
(B) In the case in which there is insuffi-
cient, or out-of-date contact information (in-
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00280
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
281 
cluding a phone number, e-mail address, or any 
other form of appropriate communication) that 
precludes direct written (or, if specified by the 
individual under subparagraph (A), electronic) 
notification to the individual, a substitute form 
of notice shall be provided, including, in the 
case that there are 10 or more individuals for 
which there is insufficient or out-of-date contact 
information, a conspicuous posting for a period 
determined by the Secretary on the home page 
of the website of the covered entity involved or 
notice in major print or broadcast media, in-
cluding major media in geographic areas where 
the individuals affected by the breach likely re-
side. Such a notice in media or web posting will 
include a toll-free phone number where an indi-
vidual can learn whether or not the individual’s 
unsecured protected health information is pos-
sibly included in the breach. 
(C) In any case deemed by the covered en-
tity involved to require urgency because of pos-
sible imminent misuse of unsecured protected 
health information, the covered entity, in addi-
tion to notice provided under subparagraph (A), 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00281
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
282 
may provide information to individuals by tele-
phone or other means, as appropriate. 
(2) MEDIA NOTICE.—Notice shall be provided 
to prominent media outlets serving a State or juris-
diction, following the discovery of a breach described 
in subsection (a), if the unsecured protected health 
information of more than 500 residents of such 
State or jurisdiction is, or is reasonably believed to 
have been, accessed, acquired, or disclosed during 
such breach. 
(3) NOTICE TO SECRETARY.—Notice shall be 
provided to the Secretary by covered entities of un-
secured protected health information that has been 
acquired or disclosed in a breach. If the breach was 
with respect to 500 or more individuals than such 
notice must be provided immediately. If the breach 
was with respect to less than 500 individuals, the 
covered entity involved may maintain a log of any 
such breach occurring and annually submit such a 
log to the Secretary documenting such breaches 
occuring during the year involved. 
(4) POSTING ON HHS PUBLIC WEBSITE.—The 
Secretary shall make available to the public on the 
Internet website of the Department of Health and 
Human Services a list that identifies each covered 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00282
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
283 
entity involved in a breach described in subsection 
(a) in which the unsecured protected health informa-
tion of more than 500 individuals is acquired or dis-
closed. 
(f) CONTENT OF NOTIFICATION.—Regardless of the 
method by which notice is provided to individuals under 
this section, notice of a breach shall include, to the extent 
possible, the following: 
(1) A brief description of what happened, in-
cluding the date of the breach and the date of the 
discovery of the breach, if known. 
(2) A description of the types of unsecured pro-
tected health information that were involved in the 
breach (such as full name, Social Security number, 
date of birth, home address, account number, or dis-
ability code). 
(3) The steps individuals should take to protect 
themselves from potential harm resulting from the 
breach. 
(4) A brief description of what the covered enti-
ty involved is doing to investigate the breach, to 
mitigate losses, and to protect against any further 
breaches. 
(5) Contact procedures for individuals to ask 
questions or learn additional information, which 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00283
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
284 
shall include a toll-free telephone number, an e-mail 
address, website, or postal address. 
(g) DELAY OF NOTIFICATION AUTHORIZED FOR LAW 
ENFORCEMENT PURPOSES.—If a law enforcement official 
determines that a notification, notice, or posting required 
under this section would impede a criminal investigation 
or cause damage to national security, such notification, 
notice, or posting shall be delayed in the same manner 
as provided under section 164.528(a)(2) of title 45, Code 
of Federal Regulations, in the case of a disclosure covered 
under such section. 
(h) UNSECURED PROTECTED HEALTH INFORMA-
TION.— 
(1) DEFINITION.— 
(A) IN
GENERAL.—Subject to subpara-
graph (B), for purposes of this section, the 
term ‘‘unsecured protected health information’’ 
means protected health information that is not 
secured through the use of a technology or 
methodology specified by the Secretary in the 
guidance issued under paragraph (2). 
(B) EXCEPTION
IN
CASE
TIMELY
GUID-
ANCE NOT ISSUED.—In the case that the Sec-
retary does not issue guidance under paragraph 
(2) by the date specified in such paragraph, for 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00284
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
285 
purposes of this section, the term ‘‘unsecured 
protected health information’’ shall mean pro-
tected health information that is not secured by 
a technology standard that renders protected 
health information unusable, unreadable, or in-
decipherable to unauthorized individuals and is 
developed or endorsed by a standards devel-
oping organization that is accredited by the 
American National Standards Institute. 
(2) GUIDANCE.—For purposes of paragraph (1) 
and section 407(f)(3), not later than the date that 
is 60 days after the date of the enactment of this 
Act, the Secretary shall, after consultation with 
stakeholders, issue (and annually update) guidance 
specifying the technologies and methodologies that 
render 
protected 
health 
information 
unusable, 
unreadable, or indecipherable to unauthorized indi-
viduals. 
(i) REPORT TO CONGRESS ON BREACHES.— 
(1) IN GENERAL.—Not later than 12 months 
after the date of the enactment of this Act and an-
nually thereafter, the Secretary shall prepare and 
submit to the Committee on Finance and the Com-
mittee on Health, Education, Labor, and Pensions 
of the Senate and the Committee on Ways and 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00285
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
286 
Means and the Committee on Energy and Commerce 
of the House of Representatives a report containing 
the information described in paragraph (2) regard-
ing breaches for which notice was provided to the 
Secretary under subsection (e)(3). 
(2) INFORMATION.—The information described 
in this paragraph regarding breaches specified in 
paragraph (1) shall include— 
(A) the number and nature of such 
breaches; and 
(B) actions taken in response to such 
breaches. 
(j) REGULATIONS; EFFECTIVE DATE.—To carry out 
this section, the Secretary of Health and Human Services 
shall promulgate interim final regulations by not later 
than the date that is 180 days after the date of the enact-
ment of this title. The provisions of this section shall apply 
to breaches that are discovered on or after the date that 
is 30 days after the date of publication of such interim 
final regulations. 
SEC. 4403. EDUCATION ON HEALTH INFORMATION PRI-
VACY. 
(a) REGIONAL OFFICE PRIVACY ADVISORS.—Not 
later than 6 months after the date of the enactment of 
this Act, the Secretary shall designate an individual in 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00286
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
287 
each regional office of the Department of Health and 
Human Services to offer guidance and education to cov-
ered entities, business associates, and individuals on their 
rights and responsibilities related to Federal privacy and 
security requirements for protected health information. 
(b) EDUCATION INITIATIVE ON USES OF HEALTH IN-
FORMATION.—Not later than 12 months after the date of 
the enactment of this Act, the Office for Civil Rights with-
in the Department of Health and Human Services shall 
develop and maintain a multi-faceted national education 
initiative to enhance public transparency regarding the 
uses of protected health information, including programs 
to educate individuals about the potential uses of their 
protected health information, the effects of such uses, and 
the rights of individuals with respect to such uses. Such 
programs shall be conducted in a variety of languages and 
present information in a clear and understandable man-
ner. 
SEC. 4404. APPLICATION OF PRIVACY PROVISIONS AND 
PENALTIES TO BUSINESS ASSOCIATES OF 
COVERED ENTITIES. 
(a) APPLICATION OF CONTRACT REQUIREMENTS.— 
In the case of a business associate of a covered entity that 
obtains or creates protected health information pursuant 
to a written contract (or other written arrangement) de-
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00287
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
288 
scribed in section 164.502(e)(2) of title 45, Code of Fed-
eral Regulations, with such covered entity, the business 
associate may use and disclose such protected health infor-
mation only if such use or disclosure, respectively, is in 
compliance with each applicable requirement of section 
164.504(e) of such title. The additional requirements of 
this subtitle that relate to privacy and that are made ap-
plicable with respect to covered entities shall also be appli-
cable to such a business associate and shall be incor-
porated into the business associate agreement between the 
business associate and the covered entity. 
(b) APPLICATION OF KNOWLEDGE ELEMENTS ASSO-
CIATED WITH CONTRACTS.—Section 164.504(e)(1)(ii) of 
title 45, Code of Federal Regulations, shall apply to a 
business associate described in subsection (a), with respect 
to compliance with such subsection, in the same manner 
that such section applies to a covered entity, with respect 
to compliance with the standards in sections 164.502(e) 
and 164.504(e) of such title, except that in applying such 
section 164.504(e)(1)(ii) each reference to the business as-
sociate, with respect to a contract, shall be treated as a 
reference to the covered entity involved in such contract. 
(c) APPLICATION
OF CIVIL
AND CRIMINAL PEN-
ALTIES.—In the case of a business associate that violates 
any provision of subsection (a) or (b), the provisions of 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00288
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
289 
sections 1176 and 1177 of the Social Security Act (42 
U.S.C. 1320d–5, 1320d–6) shall apply to the business as-
sociate with respect to such violation in the same manner 
as such provisions apply to a person who violates a provi-
sion of part C of title XI of such Act. 
SEC. 4405. RESTRICTIONS ON CERTAIN DISCLOSURES AND 
SALES OF HEALTH INFORMATION; ACCOUNT-
ING OF CERTAIN PROTECTED HEALTH IN-
FORMATION DISCLOSURES; ACCESS TO CER-
TAIN INFORMATION IN ELECTRONIC FOR-
MAT. 
(a) REQUESTED RESTRICTIONS ON CERTAIN DIS-
CLOSURES OF HEALTH INFORMATION.—In the case that 
an individual requests under paragraph (a)(1)(i)(A) of 
section 164.522 of title 45, Code of Federal Regulations, 
that a covered entity restrict the disclosure of the pro-
tected health information of the individual, notwith-
standing paragraph (a)(1)(ii) of such section, the covered 
entity must comply with the requested restriction if— 
(1) except as otherwise required by law, the dis-
closure is to a health plan for purposes of carrying 
out payment or health care operations (and is not 
for purposes of carrying out treatment); and 
(2) the protected health information pertains 
solely to a health care item or service for which the 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00289
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
290 
health care provider involved has been paid out of 
pocket in full. 
(b) DISCLOSURES REQUIRED TO BE LIMITED TO 
THE
LIMITED
DATA
SET
OR
THE
MINIMUM
NEC-
ESSARY.— 
(1) IN GENERAL.— 
(A) IN
GENERAL.—Subject to subpara-
graph (B), a covered entity shall be treated as 
being in compliance with section 164.502(b)(1) 
of title 45, Code of Federal Regulations, with 
respect to the use, disclosure, or request of pro-
tected health information described in such sec-
tion, only if the covered entity limits such pro-
tected health information, to the extent prac-
ticable, to the limited data set (as defined in 
section 164.514(e)(2) of such title) or, if needed 
by such entity, to the minimum necessary to ac-
complish the intended purpose of such use, dis-
closure, or request, respectively. 
(B) 
GUIDANCE.—Not 
later 
than 
months after the date of the enactment of this 
section, the Secretary shall issue guidance on 
what constitutes ‘‘minimum necessary’’ for pur-
poses of subpart E of part 164 of title 45, Code 
of Federal Regulation. In issuing such guidance 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00290
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
291 
the Secretary shall take into consideration the 
guidance under section 4424(c). 
(C) SUNSET.—Subparagraph (A) shall not 
apply on and after the effective date on which 
the Secretary issues the guidance under sub-
paragraph (B). 
(2) 
DETERMINATION
OF
MINIMUM
NEC-
ESSARY.—For purposes of paragraph (1), in the 
case of the disclosure of protected health informa-
tion, the covered entity or business associate dis-
closing such information shall determine what con-
stitutes the minimum necessary to accomplish the 
intended purpose of such disclosure. 
(3) APPLICATION OF EXCEPTIONS.—The excep-
tions described in section 164.502(b)(2) of title 45, 
Code of Federal Regulations, shall apply to the re-
quirement under paragraph (1) as of the effective 
date described in section 4423 in the same manner 
that such exceptions apply to section 164.502(b)(1) 
of such title before such date. 
(4) RULE OF CONSTRUCTION.—Nothing in this 
subsection shall be construed as affecting the use, 
disclosure, or request of protected health information 
that has been de-identified. 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00291
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS
316 
‘‘(ii) maintains a physical place of 
business. 
‘‘(7) LIMITATION
ON
STATE
ACTION
WHILE 
FEDERAL ACTION IS PENDING.—If the Secretary has 
instituted an action against a person under sub-
section (a) with respect to a specific violation of this 
part, no State attorney general may bring an action 
under this subsection against the person with re-
spect to such violation during the pendency of that 
action. 
‘‘(8) APPLICATION OF CMP STATUTE OF LIMI-
TATION.—A civil action may not be instituted with 
respect to a violation of this part unless an action 
to impose a civil money penalty may be instituted 
under subsection (a) with respect to such violation 
consistent with the second sentence of section 
1128A(c)(1).’’. 
(2) CONFORMING
AMENDMENTS.—Subsection 
(b) of such section, as amended by subsection (d)(3), 
is amended— 
(A) in paragraph (1), by striking ‘‘A pen-
alty may not be imposed under subsection (a)’’ 
and inserting ‘‘No penalty may be imposed 
under subsection (a) and no damages obtained 
under subsection (c)’’; 
VerDate Nov 24 2008 
22:53 Jan 28, 2009
Jkt 079200
PO 00000
Frm 00316
Fmt 6652
Sfmt 6201
E:\BILLS\H598.IH
H598
pwalker on PROD1PC71 with BILLS