(A) the conditions described in the respec-
tive section, with respect to such transaction, 
are met; or 
(B) the person or entity involved in such 
transaction acted in good faith under the belief 
that such conditions are met. 
(4) SAFE HARBORS DESCRIBED.—For purposes 
of paragraphs (1) and subsection (e), the safe har-
bors described in this paragraph are— 
(A) the safe harbor under paragraph (4) of 
section 1128A(b) of the Social Security Act (42 
U.S.C. 1320a–7a(b)), as added by subsection 
(a); 
(B) the safe harbor under subparagraph 
(J) of section 1128B(b)(3) of such Act (42 
U.S.C. 1320a–7b(b)(3)), as added by subsection 
(b); and 
(C) the safe harbor under paragraph (9) of 
section 1877(e) of such Act (42 U.S.C. 
1395nn(e)), as added by subsection (c). 
(e) INTEROPERABILITY CRITERIA FOR PERMISSIBLE 
HEALTH INFORMATION TECHNOLOGY REMUNERATION 
UNDER SAFE HARBORS.—Starting on the date that is 
four years after the effective date described in subsection 
(d)(2) and every two years thereafter, the Secretary of
Health and Human Services may issue regulations that 
establish criteria for nonmonetary remuneration (in the 
form of permitted support defined under section 
1128A(b)(4) of the Social Security Act, as added by sub-
section (a)) for purposes of the safe harbors described in 
subsection (d)(4). The Secretary shall base such criteria 
on the extent to which the permitted support conforms to 
a standard implemented under section 1150A(d) of the 
Social Security Act, as added by section 2, based on the 
following considerations: 
(1) WIDE
ACCEPTANCE
OF
STANDARD.—The 
standard is widely accepted within the health care 
industry and has been used within the industry for 
a sufficient amount of time to ensure successful im-
plementation. 
(2) NECESSITY.—The standard is necessary to 
improve the quality of health care or patient safety, 
or to provide greater administrative efficiencies. 
(3) COST BENEFIT ANALYSIS.—The results of a 
cost benefit test conducted to determine the effect of 
applying the standard for purposes of the safe har-
bors described in subsection (d)(4).
SEC. 6. UNIFORM FEDERAL AND STATE HEALTH INFORMA-
TION STANDARDS. 
(a) STUDY TO DETERMINE EXTENT OF VARIATION 
IN STATE HEALTH INFORMATION LAWS AND REGULA-
TIONS.— 
(1) IN GENERAL.—The Secretary of Health and 
Human Services shall conduct a study of State laws 
and regulations relating to the security and con-
fidentiality of individually identifiable health infor-
mation to determine— 
(A) the degree to which such laws and reg-
ulations vary among States, and between the 
States and the Federal privacy standards estab-
lished pursuant to section 264(c) of the Health 
Insurance Portability and Accountability Act of 
1996 (42 U.S.C. 1320d–2 note) and security 
standards established under section 1173(d) of 
the Social Security Act; and 
(B) how any such variation may adversely 
impact the electronic exchange of clinical health 
information among States, the Federal Govern-
ment, and private entities. 
(2) REPORT.—Not later than 18 months after 
the date of the enactment of this Act, the Secretary 
of Health and Human Services shall submit to Con-
gress a report on the study under paragraph (1) and 
shall include in such report— 
(A) a determination by the Secretary 
whether the State laws and regulations de-
scribed in such paragraph should be conformed 
to a set of Federal standards to protect the se-
curity and confidentiality of patient health in-
formation and to improve health care quality or 
efficiency; and 
(B) recommendations for legislation to 
conform such State laws and regulations to 
such a set of Federal standards. 
(3) STATE
DEFINED.—For purposes of this 
subsection, the term ‘‘State’’ has the meaning given 
such term when used in title XI of the Social Secu-
rity Act, as provided under section 1101(a) of such 
Act (42 U.S.C. 1301(a)). 
(b) CONFIDENTIALITY AND SECURITY REGULATIONS 
PREEMPTION OF STATE LAWS IF CONGRESS FAILS TO 
ESTABLISH UNIFORM STANDARDS.— 
(1) IN GENERAL.—Section 1178(a) of the So-
cial Security Act (42 U.S.C. 1320d–7(a)) is amend-
ed—
(A) in paragraph (1) by inserting after 
‘‘Except as provided in paragraph (2)’’ the fol-
lowing: ‘‘and subject to paragraph (3)’’; and 
(B) by adding at the end the following new 
paragraph: 
‘‘(3) UNIFORM STANDARDS.— 
‘‘(A) IN GENERAL.—If legislation to create 
uniform Federal standards, and to preempt 
State laws, with respect to the confidentiality 
and security of individually identifiable health 
information is not enacted by Congress on the 
date that is 36 months after the date of the en-
actment of the Electronic Health Information 
Technology Act of 2006, the regulation and 
standards described in subparagraph (B) shall 
supersede any contrary provision of State law. 
‘‘(B) APPLICATION
OF
UNIFORM
STAND-
ARDS.—The regulation and standards described 
in this subparagraph are the regulation promul-
gated under section 264(c)(1) of the Health In-
surance Portability and Accountability Act of 
1996 and the standards under section 1173(d), 
as modified by the Secretary to the extent the 
Secretary determines, after consideration of the 
results of the study conducted under section
6(a) of the Electronic Health Information Tech-
nology Act of 2006, necessary to promote uni-
form national standards.’’. 
(2) HIPAA CONFORMING
AMENDMENT.—Sec-
tion 264(c)(2) of the Health Insurance Portability 
and Accountability Act of 1996 (42 U.S.C. 1320d– 
2 note) is amended by striking ‘‘A regulation’’ and 
inserting ‘‘(A) Subject to section 1178(a)(3) of the 
Social Security Act, a regulation’’. 
Æ