135 
(d) NOTIFICATION OF THE SECRETARY.—Upon re-
ceipt of a notification of a breach of security under sub-
section (a)(2), the Federal Trade Commission shall notify 
the Secretary of such breach. 
(e) ENFORCEMENT.—A violation of subsection (a) or 
(b) shall be treated as an unfair and deceptive act or prac-
tice in violation of a regulation under section 18(a)(1)(B) 
of the Federal Trade Commission Act (15 U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or prac-
tices. 
(f) DEFINITIONS.—For purposes of this section: 
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’ means, with respect to unsecured PHR 
identifiable health information of an individual in a 
personal health record, the acquisition, use, or dis-
closure of such information without the authoriza-
tion of the individual. 
(2) PHR IDENTIFIABLE
HEALTH
INFORMA-
TION.—The term ‘‘PHR identifiable health informa-
tion’’ means individually identifiable health informa-
tion, as defined in section 1171(6) of the Social Se-
curity Act (42 U.S.C. 1320d(6)), and includes, with 
respect to an individual, information— 
(A) that is provided by or on behalf of the 
individual; and 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00135
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
136 
(B) that identifies the individual or with 
respect to which there is a reasonable basis to 
believe that the information can be used to 
identify the individual. 
(3) UNSECURED
PHR
IDENTIFIABLE
HEALTH 
INFORMATION.— 
(A) IN
GENERAL.—Subject to subpara-
graph (B), the term ‘‘unsecured PHR identifi-
able health information’’ means PHR identifi-
able health information that is not protected 
through the use of a technology or methodology 
specified by the Secretary in the guidance 
issued under section 402(h)(2). 
(B) EXCEPTION
IN
CASE
TIMELY
GUID-
ANCE NOT ISSUED.—In the case that the Sec-
retary does not issue guidance under section 
402(h)(2) by the date specified in such section, 
for purposes of this section, the term ‘‘unse-
cured PHR identifiable health information’’ 
shall mean information that is not protected by 
technology standards developed or endorsed by 
a standards developing organization that is ac-
credited by the American National Standards 
Institute. 
(g) EFFECTIVE DATE; SUNSET.— 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00136
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
137 
(1) IN GENERAL.—Subject to paragraph (2), 
the provisions of this section shall apply to breaches 
of security occurring during the period beginning on 
the date that is 90 days after the date of the enact-
ment of this Act. 
(2) SUNSET.—The provisions of this section 
shall not apply to breaches of security occurring on 
or after the earlier of the following: 
(A) A standard relating to requirements 
for entities that are not covered entities that in-
cludes requirements relating to breach notifica-
tion has been adopted by the Secretary under 
section 3002 of the Public Health Service Act, 
as added by section 101, and has taken effect. 
(B) A standard relating to requirements 
for entities that are not covered entities that in-
cludes requirements relating to breach notifica-
tion has been promulgated by the Federal 
Trade Commission and has taken effect. 
SEC. 409. BUSINESS ASSOCIATE CONTRACTS REQUIRED 
FOR CERTAIN ENTITIES; OTHER PROVISIONS 
RELATED TO BUSINESS ASSOCIATE CON-
TRACTS. 
(a) IN GENERAL.—Each organization, with respect 
to a covered entity, that provides data transmission of pro-
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00137
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
138 
tected health information to such entity and that requires 
access on a routine basis to such protected health informa-
tion, such as a Health Information Exchange, Regional 
Health Information Organization, or E-prescribing Gate-
way and each vendor of a personal health record that con-
tracts with a covered entity for purposes of including a 
personal health record within an electronic medical record 
or electronic health record, is required to enter into a writ-
ten contract (or other written arrangement) described in 
section 164.502(e)(2) of title 45, Code of Federal Regula-
tions and a written contract (or other arrangement) de-
scribed in section 164.308(b) of such title, with such enti-
ty and shall be treated as a business associate of the cov-
ered entity for purposes of the provisions of this title and 
subparts C and E of title 45, Code of Federal Regulations. 
(b) COVERED ENTITIES TO MONITOR COMPLIANCE 
OF BUSINESS ASSOCIATES.— 
(1) IN GENERAL.—A covered entity shall mon-
itor the extent to which a business associate of such 
entity complies with the terms of the written con-
tract (or other arrangement) described in section 
164.502(e)(2) of title 45, Code of Federal Regula-
tions or section 164. 308(b) of such title, as applica-
ble, entered into between such entity and such busi-
ness associate. 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00138
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
139 
(2) ENFORCEMENT.—If in the process of inves-
tigating a complaint related to a violation of the re-
quirements of this title or subpart C or E of title 45, 
Code of Federal Regulations, committed by a busi-
ness associate of a covered entity, the Office for 
Civil Rights of the Department of Health and 
Human Services determines that— 
(A) the covered entity reasonably should 
have known of a pattern of activity or practice 
of the business associate that was not in com-
pliance with the terms of a contract described 
in paragraph (1) and that relates to such viola-
tion; and 
(B) the covered entity did not take action 
required under section 164.504(e)(1)(ii) of title 
45, Code of Federal Regulations in response to 
such pattern or practice, 
the covered entity shall be treated, for purposes of 
section 1176 of the Social Security Act (42 U.S.C. 
1320d–5), as having violated part C of title XI of 
such Act. 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00139
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
140 
SEC. 410. GUIDANCE ON IMPLEMENTATION SPECIFICATION 
TO DE-IDENTIFY PROTECTED HEALTH INFOR-
MATION. 
Not later than 12 months after the date of the enact-
ment of this Act, the Secretary shall, in consultation with 
stakeholders, issue guidance on how best to implement the 
requirements for the de-identification of protected health 
information under section 164.514(b) of title 45, Code of 
Federal Regulations. 
SEC. 411. GAO REPORT ON TREATMENT, PAYMENT, AND 
HEALTH CARE OPERATIONS USES AND DIS-
CLOSURES. 
Not later than one year after the date of the enact-
ment of this Act, the Comptroller General of the United 
States shall submit to the Committee on Finance and the 
Committee on Health, Education, Labor, and Pensions of 
the Senate and the Committee on Ways and Means and 
the Committee on Energy and Commerce of the House 
of Representatives a report on— 
(1) the best practices related to the disclosure 
among health care providers of protected health in-
formation of an individual for purposes of treatment 
of such individual, including an examination of the 
best practices implemented by States and by other 
entities, such as health information exchanges and 
regional health information organizations, and an 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00140
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
141 
examination of the extent to which such best prac-
tices are successful with respect to the quality of the 
resulting health care provided to the individual and 
with respect to the ability of the health care provider 
to manage such best practices; and 
(2) the best practices with respect to deter-
mining the minimum necessary set of protected 
health information for uses and disclosures of such 
information for purposes of payment and the most 
common health care operations, as specified by the 
Secretary, including those health care operations 
that could be reasonably and efficiently performed 
with either de-identified data (as defined in section 
164.514(a) of title 45, Code of Federal Regulations) 
or the limited data set (as defined section 
164.514(e)(1) of such title). 
SEC. 412. CLARIFICATION OF APPLICATION OF WRONGFUL 
DISCLOSURES CRIMINAL PENALTIES. 
Section 1177(a) of the Social Security Act (42 U.S.C. 
1320d–6(a)) is amended by adding at the end the fol-
lowing new sentence: ‘‘For purposes of the previous sen-
tence, a person (including an employee or other individual 
who is not a covered entity, as defined in the HIPAA pri-
vacy regulation described in section 1180(b)(3)) shall be 
considered to have obtained or disclosed individually iden-
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00141
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
142 
tifiable health information in violation of this part if the 
information is maintained by a covered entity (as so de-
fined) and the person knowingly obtained or disclosed such 
information without authorization.’’. 
SEC. 413. IMPROVED ENFORCEMENT. 
(a) IMPROVED CIVIL PENALTIES.— 
(1) IN GENERAL.—Section 1176 of the Social 
Security Act (42 U.S.C. 1320d–5) is amended— 
(A) in subsection (b)(1), by striking ‘‘the 
act constitutes an offense punishable under sec-
tion 1177’’ and inserting ‘‘a penalty has been 
imposed under section 1177 with respect to 
such act’’; and 
(B) by adding at the end the following new 
subsection: 
‘‘(c) NONCOMPLIANCE
DUE
TO
WILLFUL
NE-
GLECT.— 
‘‘(1) IN GENERAL.—A violation of a provision 
of this part due to willful neglect is a violation for 
which the Secretary is required to impose a penalty 
under subsection (a)(1). 
‘‘(2) REQUIRED INVESTIGATION.—For purposes 
of paragraph (1), the Secretary shall formally inves-
tigate any complaint of a violation of a provision of 
this part if a preliminary investigation of the facts 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00142
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
143 
of the complaint indicate such a possible violation 
due to willful neglect. 
‘‘(3) REGULATIONS.—Not later than 90 days 
after the date of the enactment of the Health-e In-
formation Technology Act of 2008, the Secretary 
shall issue a notice of proposed rulemaking in the 
Federal Register to implement this subsection.’’. 
(2) EFFECTIVE DATE.—The amendments made 
by paragraph (1) shall apply to penalties imposed on 
or after the date specified in section 433. 
(b) DISTRIBUTION OF CIVIL MONETARY PENALTIES 
COLLECTED.— 
(1) IN
GENERAL.—Subject to the regulation 
promulgated pursuant to paragraph (3), any civil 
monetary penalty collected with respect to an offense 
punishable under this title or section 1176 of the 
Social Security Act (42 U.S.C. 1320d–5) shall be 
transferred to the Office of Civil Rights of the De-
partment of Health and Human Services to be used 
for purposes of enforcing the provisions of this title 
and subparts C and E of title 45, Code of Federal 
Regulations. 
(2) GAO REPORT.—Not later than 18 months 
after the date of the enactment of this Act, the 
Comptroller General shall submit to the Secretary a 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00143
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
144 
report including recommendations for a methodology 
under which an individual who is harmed by an act 
that constitutes an offense punishable under this 
title or section 1176 of the Social Security Act may 
receive a percentage of any civil monetary penalty 
collected with respect to such offense under this title 
or such section. 
(3) ESTABLISHMENT
OF
METHODOLOGY
TO 
DISTRIBUTE PERCENTAGE OF CMPS COLLECTED TO 
HARMED INDIVIDUALS.—Not later 3 years after the 
date of the enactment of this Act, the Secretary 
shall establish by regulation and based on the rec-
ommendations submitted under paragraph (2), a 
methodology under which an individual who is 
harmed by an act that constitutes an offense punish-
able under this title or section 1176 of the Social 
Security Act may receive a percentage of any civil 
monetary penalty collected with respect to such of-
fense under this title or such section. 
(4) APPLICATION
OF
METHODOLOGY.—The 
methodology under paragraph (3) shall be applied 
with respect to civil monetary penalties imposed on 
or after the effective date of the regulation. 
(c) TIERED INCREASE IN AMOUNT OF CIVIL MONE-
TARY PENALTIES.— 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00144
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
145 
(1) IN GENERAL.—Section 1176(a)(1) of the 
Social Security Act (42 U.S.C. 1320d–5(a)(1)) is 
amended by striking ‘‘who violates a provision of 
this part a penalty of not more than’’ and all that 
follows and inserting the following: ‘‘who violates a 
provision of this part— 
‘‘(A) in the case of a violation of such pro-
vision in which it is established to the satisfac-
tion of the Secretary that the person did not 
know (and by exercising reasonable diligence 
would not have known) that such person vio-
lated such provision, a penalty for each such 
violation of an amount that is at least the 
amount described in paragraph (3)(A) but not 
to exceed the amount described in paragraph 
(3)(D); 
‘‘(B) in the case of a violation of such pro-
vision in which it is established to the satisfac-
tion of the Secretary that the violation was due 
to reasonable cause and not to willful neglect, 
a penalty for each such violation of an amount 
that is at least the amount described in para-
graph (3)(B) but not to exceed the amount de-
scribed in paragraph (3)(D); and 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00145
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
146 
‘‘(C) in the case of a violation of such pro-
vision in which it is established to the satisfac-
tion of the Secretary that the violation was due 
to willful neglect— 
‘‘(i) if the violation is corrected as de-
scribed in subsection (b)(3)(A), a penalty 
in an amount that is at least the amount 
described in paragraph (3)(C) but not to 
exceed the amount described in paragraph 
(3)(D); and 
‘‘(ii) if the violation is not corrected 
as described in such subsection, a penalty 
in an amount that is at least the amount 
described in paragraph (3)(D). 
In determining the amount of a penalty under 
this section for a violation, the Secretary shall 
base such determination on the nature and ex-
tent of the violation and the nature and extent 
of the harm resulting from such violation.’’. 
(2) TIERS OF PENALTIES DESCRIBED.—Section 
1176(a) of such Act (42 U.S.C. 1320d–5(a)) is fur-
ther amended by adding at the end the following 
new paragraph: 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00146
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
147 
‘‘(3) TIERS
OF
PENALTIES
DESCRIBED.—For 
purposes of paragraph (1), with respect to a viola-
tion by a person of a provision of this part— 
‘‘(A) the amount described in this subpara-
graph is $100 for each such violation, except 
that the total amount imposed on the person 
for all such violations of an identical require-
ment or prohibition during a calendar year may 
not exceed $25,000; 
‘‘(B) the amount described in this subpara-
graph is $1,000 for each such violation, except 
that the total amount imposed on the person 
for all such violations of an identical require-
ment or prohibition during a calendar year may 
not exceed $100,000; 
‘‘(C) the amount described in this subpara-
graph is $10,000 for each such violation, except 
that the total amount imposed on the person 
for all such violations of an identical require-
ment or prohibition during a calendar year may 
not exceed $250,000; and 
‘‘(D) the amount described in this sub-
paragraph is $50,000 for each such violation, 
except that the total amount imposed on the 
person for all such violations of an identical re-
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00147
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
148 
quirement or prohibition during a calendar year 
may not exceed $1,500,000.’’. 
(3) 
CONFORMING
AMENDMENTS.—Section 
1176(b) of such Act (42 U.S.C. 1320d–5(b)) is 
amended— 
(A) by striking paragraph (2) and redesig-
nating paragraphs (3) and (4) as paragraphs 
(2) and (3), respectively; and 
(B) in paragraph (3)— 
(i) in subparagraph (A), by striking 
‘‘in subparagraph (B), a penalty may not 
be imposed under subsection (a) if’’ and all 
that follows through ‘‘the failure to comply 
is corrected’’ and inserting ‘‘in subpara-
graph (B) or subsection (a)(1)(C), a pen-
alty may not be imposed under subsection 
(a) if the failure to comply is corrected’’; 
and 
(ii) in subparagraph (B), by striking 
‘‘(A)(ii)’’ each place it appears and insert-
ing ‘‘(A)’’. 
(4) EFFECTIVE DATE.—The amendments made 
by this subsection shall apply to violations occurring 
after the date of the enactment of this Act. 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00148
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
149 
(d) ENFORCEMENT
BY STATE ATTORNEYS GEN-
ERAL.— 
(1) CIVIL ACTIONS.—In any case in which the 
attorney general of a State or any State or local law 
enforcement agency authorized by the State attorney 
general or by State law to prosecute violations of 
consumer protection laws, has reason to believe that 
an interest of the residents of that State has been 
or is threatened or adversely affected by the engage-
ment of a person in a practice that is prohibited 
under a provision of this title or subparts C or E of 
title 45, Code of Federal Regulations, the State or 
local law enforcement agency on behalf of the resi-
dents of the agency’s jurisdiction, may bring a civil 
action on behalf of the residents of the State or ju-
risdiction in a district court of the United States of 
appropriate jurisdiction to— 
(A) enjoin that act or practice; 
(B) enforce compliance with the provision; 
or 
(C) obtain civil penalties in an amount cal-
culated by multiplying the number of violations 
by an amount not greater than $11,000. 
(2) RULE OF CONSTRUCTION.—For purposes of 
bringing any civil action under paragraph (1), noth-
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00149
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
150 
ing in this title regarding notification shall be con-
strued to prevent an attorney general of a State 
from exercising the powers conferred on such attor-
ney general by the laws of that State to— 
(A) conduct investigations; 
(B) administer oaths or affirmations; or 
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(3) VENUE; SERVICE OF PROCESS.— 
(A) VENUE.—Any action brought under 
paragraph (1) may be brought in the district 
court of the United States that meets applicable 
requirements relating to venue under section 
1391 of title 28, United States Code. 
(B) SERVICE OF PROCESS.—In an action 
brought under paragraph (1), process may be 
served in any district in which the defendant— 
(i) is an inhabitant; or 
(ii) may be found. 
SEC. 414. AUDITS. 
The Secretary shall provide for periodic audits to en-
sure that entities that are subject to the requirements of 
this title and subparts C and E of title 45, Code of Federal 
Regulations, comply with such requirements. 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00150
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
151 
SEC. 415. TECHNICAL AMENDMENT. 
Section 1171(5) of the Social Security Act (42 U.S.C. 
1320d) is amended by striking ‘‘or C’’ and inserting ‘‘C, 
or D’’. 
Subtitle B—Chief Privacy Officer 
of 
ONCHIT; 
Standards 
and 
Guidance Recommendations Re-
lated to Privacy and Security 
SEC. 421. CHIEF PRIVACY OFFICER OF THE OFFICE OF THE 
NATIONAL COORDINATOR . 
(a) IN GENERAL.—To assist the National Coordi-
nator in carrying out all the duties of the National Coordi-
nator relating to the privacy and security of health infor-
mation, not later than 12 months after the date of the 
enactment of this Act, the Secretary shall appoint a Chief 
Privacy Officer of the Office of the National Coordinator 
established under section 3001(a) of the Public Health 
Service Act, as added by section 101. 
(b) CONSULTATION.—In carrying out the duties 
under subsection (a), the Chief Privacy Officer shall con-
sult with the officials designated under subsection (c)(1) 
and is encouraged to consult with officials in other Federal 
agencies who have primary responsibility relating to the 
privacy and security of individually identifiable informa-
tion. 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00151
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
152 
(c) COORDINATION WITH INTERNAL PRIVACY OFFI-
CERS.—The Secretary shall ensure that— 
(1) not later than 12 months after the date of 
the enactment of this Act, each agency specified by 
the Secretary with the Department of Health and 
Human Services that deals with health information 
has an official who is designated with specific re-
sponsibilities with regard to the privacy and security 
of such information; and 
(2) such officials coordinate their activities with 
the Chief Privacy Officer. 
SEC. 422. ADDITIONAL STANDARDS AND GUIDANCE REC-
OMMENDATIONS RELATED TO PRIVACY AND 
SECURITY. 
(a) IN GENERAL.—In carrying out section 3001(c)(2) 
of the Public Health Service Act, as added by section 101, 
the National Coordinator shall— 
(1) periodically recommend to the Secretary 
standards and guidance related to ensuring the pri-
vacy and security of health information for purposes 
of adoption under section 3003(a) of such Act, as so 
added; and 
(2) periodically review and revise as necessary 
health information privacy and security standards 
and regulations implemented under this title and 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00152
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
153 
subparts C and E of title 45, Code of Federal Regu-
lations. 
(b) SPECIFIC RECOMMENDATIONS.—For purposes of 
subsection (a), the National Coordinator shall submit to 
the Secretary recommendations on at least the following: 
(1) APPLICATION OF HIPAA TO ENTITIES THAT 
AREN’T COVERED ENTITIES.—Taking into account 
the results of the study conducted under section 
407, recommendations— 
(A) on the extent to which the provisions 
of this title and subparts C and E of title 45, 
Code of Federal Regulations, should apply to 
entities using, disclosing or receiving health in-
formation that are not included under this title 
or such subparts as a covered entity or business 
associate; and 
(B) that identify to which entities that are 
not so included should such provisions apply. 
(2) COLLECTION LIMITATIONS.—Recommenda-
tions identifying under what circumstances and for 
what purposes protected health information may be 
collected, including model notices for such purposes 
as necessary and recommendations about which of 
such purposes should require separate, prior author-
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00153
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
154 
ization from the individual involved. Such rec-
ommendations shall provide that— 
(A) such collection will occur in a trans-
parent process; 
(B) such collection shall be in accordance 
with applicable Federal, State, and local laws; 
and 
(C) such collection may only occur for the 
purposes specified by the entity collecting the 
information and such purposes must be so spec-
ified at least not later than the time of collec-
tion. 
(3) DISCLOSURE AND USE LIMITATIONS.—Rec-
ommendations identifying the circumstances under 
which, to whom, and for what purposes protected 
health information may be used or disclosed, includ-
ing— 
(A) recommendations about what uses or 
purposes are permitted or required (taking into 
account that protected health information shall 
be disclosed in a non-identifiable manner to the 
maximum extent possible); 
(B) recommendations on best practices on 
de-identifying data; 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00154
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
155 
(C) recommendations for a technical stand-
ard that allows for the de-identification of 
health information; 
(D) recommendations on how to segregate 
sensitive protected health information with the 
goal of minimizing the reluctance of patients to 
seek care (or disclose information about a con-
dition) because of privacy concerns involving 
sensitive protected health information while 
maximizing patient safety and clinical utility of 
the information; 
(E) recommendations to define the ‘‘min-
imum necessary’’ set of health information for 
the most common treatment and health care 
operations, as specified by the Secretary; and 
(F) recommendations for standardized no-
tification describing, in terms that are easily 
understandable to individuals, permissible uses 
and disclosures for the most common payment 
and health care operations purposes and spe-
cific to the most common covered entities. 
(4) ELECTRONIC HEALTH RECORDS AND ELEC-
TRONIC MEDICAL RECORDS SECURITY FEATURES.— 
Recommendations on security features, such as user 
authentication, identity management tools, and data 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00155
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS
156 
scrubbing, that electronic health records must have 
in order to receive certification under the program 
under section 3001(c)(3) of the Public Health Serv-
ice Act, as added by section 101. Such recommenda-
tions shall include at a minimum recommendations 
with respect to immutable audit trails. 
(5) DATA
ACCURACY.—Recommendations on 
how to maximize the accuracy of health information 
used or disclosed. 
(6) ACCOUNTABILITY.—Recommendations on 
how to best provide for accountability for uses and 
disclosures of health information. 
(7) 
TRANSPARENCY.—Recommendations 
on 
how to maximize the transparency and openness of 
health information privacy and security policies, in-
cluding requiring that notices informing individuals 
of such policies be written in an understandable and 
simple manner and clearly and simply describe what 
the privacy and security policies are and how indi-
viduals can access their protected health information 
and amend it. 
(8) ENFORCEMENT.—Recommendation on how 
to improve and revise the enforcement of this title 
and subparts C and E of title 45, Code of Federal 
Regulations. 
VerDate Aug 31 2005 
02:32 Sep 20, 2008
Jkt 069200
PO 00000
Frm 00156
Fmt 6652
Sfmt 6201
E:\BILLS\H6898.IH
H6898
rfrederick on PROD1PC67 with BILLS