(1) provides at least as much protection as oth-
erwise provided under this Act and under HIPAA 
regulations; and 
(2) does not prohibit or restrict the exchange of 
health information across State borders. 
(d) STATE DEFINED.—For purposes of this section, 
the term ‘‘State’’ has the meaning given such term when 
used in title XI of the Social Security Act, as provided 
under section 1101(a) of such Act (42 U.S.C. 1301(a)). 
SEC. 8. REGULATORY OVERSIGHT. 
(a) IN GENERAL.—In carrying out this Act, the 
Board of Governors, acting through the Under Secretary 
for Technology or other appropriate official, shall— 
(1) develop a program to certify entities to op-
erate independent health record banks; 
(2) provide assistance to encourage the growth 
of independent health record banks; 
(3) track economic progress as it pertains to 
independent health record bank operators and indi-
viduals receiving non-taxable income with respect to 
accounts; 
(4) conduct public education activities regarding 
the creation and use of the independent health 
record banks; 
VerDate Aug 31 2005 
02:27 Jun 10, 2006
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H5559.IH
H5559
jcorcoran on PROD1PC62 with BILLS
(5) establish an interagency council under sub-
section (b) to develop standards for Federal security 
auditing for entities operating independent health 
record banks; and 
(6) carry out any other activities determined 
appropriate by the Board of Governors. 
(b) INTERAGENCY COUNCIL FOR SECURITY AUDIT-
ING.— 
(1) IN GENERAL.—The Board of Governors, in 
consultation with the Secretary of Health and 
Human Services and other appropriate Federal offi-
cials, shall establish an interagency council to de-
velop standards for Federal security auditing as it 
relates to data security, authentication, and author-
ization recommendations, and reviews of inde-
pendent health record banks. 
(2) DUTIES.—The interagency council estab-
lished under paragraph (1) shall take into consider-
ation the following factors when developing rec-
ommendations for security, authentication, and au-
thorization of information in independent health 
record banks: 
(A) The number and type of factors used 
for the exchange of protected health informa-
tion. 
VerDate Aug 31 2005 
02:27 Jun 10, 2006
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H5559.IH
H5559
jcorcoran on PROD1PC62 with BILLS
(B) The requirement that individuals, who 
have health records that are maintained by the 
bank, be notified of a security breech with re-
spect to such records, and any corrective action 
taken on behalf of the individual. 
(C) The requirement that information sent 
to, or received from, an independent health 
record bank that has been designated as high- 
risk should be authenticated through the use of 
methods such as the periodic changing of pass-
words, the use of biometrics, the use of tokens 
or other technology as determined appropriate 
by the council. 
(D) Recommendations for entities oper-
ating independent health record banks, includ-
ing requiring analysis of the potential risk of 
health transaction security breaches based on 
set criteria. 
(E) The conduct of audits of independent 
health record banks to ensure that they are in 
compliance with the requirements and stand-
ards established under this Act. 
(3) COMPLIANCE
REPORT.—The interagency 
council established under this subsection shall annu-
ally submit to the Board of Governors a report on 
VerDate Aug 31 2005 
02:27 Jun 10, 2006
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H5559.IH
H5559
jcorcoran on PROD1PC62 with BILLS
compliance by independent health record banks with 
the requirements and standard under this Act. Such 
report shall be included in the corresponding annual 
report required under subsection (d). 
(c) 
INTERAGENCY
MEMORANDUM
OF
UNDER-
STANDING.—The Board of Governors and the Secretary 
of Health and Human Services, and other Federal officials 
that may be impacted by this Act, shall ensure, through 
the execution of an interagency memorandum of under-
standing among the Board, Secretary, and officials, 
that— 
(1) regulations, rulings, and interpretations 
issued by such Board, Secretary, or officials relating 
to the same matter over which two or more of such 
entities have responsibility under this Act are ad-
ministered so as to have the same effect at all times; 
and 
(2) coordination of policies relating to enforcing 
the same requirements through the Board, Sec-
retary, or officials in order to have a coordinated en-
forcement strategy that avoids duplication of en-
forcement efforts and assigns priorities in enforce-
ment. 
(d) ANNUAL REPORT.—Not later than one year after 
the date of the enactment of this Act, and annually there-
VerDate Aug 31 2005 
02:27 Jun 10, 2006
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H5559.IH
H5559
jcorcoran on PROD1PC62 with BILLS
after, the Secretary, acting through the Under Secretary 
for Technology, shall submit to the Committee on Energy 
and Commerce and the Committee on Ways and Means 
of the House of Representatives and the Committee on 
Health, Education, Labor, and Pensions and the Com-
mittee on Finance of the Senate, a report that— 
(1) describes individual owner or institution op-
erator economic progress as achieved through the 
use of independent health record bank and existing 
barriers to such use; 
(2) describes progress in security auditing as 
provided for by the interagency security council 
under subsection (b); and 
(3) contains information on the other duties of 
the Board of Governors, as described in subsection 
(a). 
SEC. 9. PENALTIES FOR WRONGFUL DISCLOSURE. 
The penalties provided for in subsection (a) of section 
1177 of the Social Security Act (42 U.S.C. 1320d–6) shall 
apply to the wrongful disclosure of information collected, 
maintained, or made available by an independent health 
record bank under this Act, including disclosures by any 
employees or associates of any such bank or other health 
care entity using or disclosing such information, in the 
VerDate Aug 31 2005 
02:27 Jun 10, 2006
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H5559.IH
H5559
jcorcoran on PROD1PC62 with BILLS