130
(1) by striking ‘‘or’’ at the end of subparagraph
(A);
(2) by inserting ‘‘or’’ at the end of subparagraph
(B); and
(3) by adding at the end the following:
‘‘(C) committing or about to commit a Federal
health care offense.’’.
(b) FREEZING OF ASSETS.—Section 1345(a)(2) of title
18, United States Code, is amended by inserting ‘‘or a Fed-
eral health care offense’’ after ‘‘title)’’.
SEC. 248. AUTHORIZED INVESTIGATIVE DEMAND PROCE-
DURES.
(a) IN GENERAL.—Chapter 223 of title 18, United
States Code, is amended by adding after section 3485 the
following:
‘‘§ 3486. Authorized investigative demand procedures
‘‘(a) AUTHORIZATION.—In any investigation relating
to any act or activity involving a Federal health care of-
fense, the Attorney General or the Attorney General’s des-
ignee may issue in writing and cause to be served a sub-
poena requiring the production of any records (including
any books, papers, documents, electronic media, or other ob-
jects or tangible things), which may be relevant to an au-
thorized law enforcement inquiry, that a person or legal en-
tity may possess or have care, custody, or control. A sub-
131
poena shall describe the objects required to be produced and
prescribe a return date within a reasonable period of time
within which the objects can be assembled and made avail-
able.
‘‘(b) SERVICE.—A subpoena issued under this section
may be served by any person designated in the subpoena
to serve it. Service upon a natural person may be made
by personal delivery of the subpoena to him. Service may
be made upon a domestic or foreign corporation or upon
a partnership or other unincorporated association which is
subject to suit under a common name, by delivering the sub-
poena to an officer, to a managing or general agent, or to
any other agent authorized by appointment or by law to
receive service of process. The affidavit of the person serving
the subpoena entered on a true copy thereof by the person
serving it shall be proof of service.
‘‘(c) ENFORCEMENT.—In the case of contumacy by or
refusal to obey a subpoena issued to any person, the Attor-
ney General may invoke the aid of any court of the United
States within the jurisdiction of which the investigation is
carried on or of which the subpoenaed person is an inhab-
itant, or in which he carries on business or may be found,
to compel compliance with the subpoena. The court may
issue an order requiring the subpoenaed person to appear
before the Attorney General to produce records, if so ordered,
132
or to give testimony touching the matter under investiga-
tion. Any failure to obey the order of the court may be pun-
ished by the court as a contempt thereof. All process in any
such case may be served in any judicial district in which
such person may be found.
‘‘(d) IMMUNITY FROM CIVIL LIABILITY.—Notwith-
standing any Federal, State, or local law, any person, in-
cluding officers, agents, and employees, receiving a sum-
mons under this section, who complies in good faith with
the summons and thus produces the materials sought, shall
not be liable in any court of any State or the United States
to any customer or other person for such production or for
nondisclosure of that production to the customer.
‘‘(e) LIMITATION ON USE.—(1) Health information
about an individual that is disclosed under this section may
not be used in, or disclosed to any person for use in, any
administrative, civil, or criminal action or investigation
directed against the individual who is the subject of the in-
formation unless the action or investigation arises out of
and is directly related to receipt of health care or payment
for health care or action involving a fraudulent claim relat-
ed to health; or if authorized by an appropriate order of
a court of competent jurisdiction, granted after application
showing good cause therefor.
133
‘‘(2) In assessing good cause, the court shall weigh the
public interest and the need for disclosure against the in-
jury to the patient, to the physician-patient relationship,
and to the treatment services.
‘‘(3) Upon the granting of such order, the court, in
determining the extent to which any disclosure of all or any
part of any record is necessary, shall impose appropriate
safeguards against unauthorized disclosure.’’.
(b) CLERICAL AMENDMENT.—The table of sections at
the beginning of chapter 223 of title 18, United States Code,
is amended by inserting after the item relating to section
3485 the following new item:
‘‘3486. Authorized investigative demand procedures.’’.
(c) 
CONFORMING
AMENDMENT.—Section
1510(b)(3)(B) of title 18, United States Code, is amended
by inserting ‘‘or a Department of Justice subpoena (issued
under section 3486 of title 18),’’ after ‘‘subpoena’’.
SEC. 249. FORFEITURES FOR FEDERAL HEALTH CARE OF-
FENSES.
(a) IN GENERAL.—Section 982(a) of title 18, United
States Code, is amended by adding after paragraph (5) the
following new paragraph:
‘‘(6) The court, in imposing sentence on a person con-
victed of a Federal health care offense, shall order the person
to forfeit property, real or personal, that constitutes or is
134
derived, directly or indirectly, from gross proceeds traceable
to the commission of the offense.’’.
(b) CONFORMING AMENDMENT.—Section 982(b)(1)(A)
of title 18, United States Code, is amended by inserting
‘‘or (a)(6)’’ after ‘‘(a)(1)’’.
(c) PROPERTY FORFEITED DEPOSITED IN FEDERAL
HOSPITAL INSURANCE TRUST FUND.—
(1) IN GENERAL.—After the payment of the costs
of asset forfeiture has been made, and notwithstand-
ing any other provision of law, the Secretary of the
Treasury shall deposit into the Federal Hospital In-
surance 
Trust 
Fund 
pursuant 
to 
section
1817(k)(2)(C) of the Social Security Act, as added by
section 301(b), an amount equal to the net amount re-
alized from the forfeiture of property by reason of a
Federal health care offense pursuant to section
982(a)(6) of title 18, United States Code.
(2) COSTS
OF
ASSET
FORFEITURE.—For pur-
poses of paragraph (1), the term ‘‘payment of the
costs of asset forfeiture’’ means—
(A) the payment, at the discretion of the At-
torney General, of any expenses necessary to
seize, detain, inventory, safeguard, maintain, ad-
vertise, sell, or dispose of property under seizure,
detention, or forfeited, or of any other necessary
135
expenses incident to the seizure, detention, for-
feiture, or disposal of such property, including
payment for—
(i) contract services,
(ii) the employment of outside contrac-
tors to operate and manage properties or
provide other specialized services necessary
to dispose of such properties in an effort to
maximize the return from such properties;
and
(iii) reimbursement of any Federal,
State, or local agency for any expenditures
made to perform the functions described in
this subparagraph;
(B) at the discretion of the Attorney Gen-
eral, the payment of awards for information or
assistance leading to a civil or criminal forfeit-
ure involving any Federal agency participating
in the Health Care Fraud and Abuse Control Ac-
count;
(C) the compromise and payment of valid
liens and mortgages against property that has
been forfeited, subject to the discretion of the At-
torney General to determine the validity of any
such lien or mortgage and the amount of pay-
136
ment to be made, and the employment of attor-
neys and other personnel skilled in State real es-
tate law as necessary;
(D) payment authorized in connection with
remission or mitigation procedures relating to
property forfeited; and
(E) the payment of State and local property
taxes on forfeited real property that accrued be-
tween the date of the violation giving rise to the
forfeiture and the date of the forfeiture order.
Subtitle F—Administrative
Simplification
SEC. 251. PURPOSE.
It is the purpose of this subtitle to improve the medi-
care program under title XVIII of the Social Security Act,
the medicaid program under title XIX of such Act, and the
efficiency and effectiveness of the health care system, by en-
couraging the development of a health information system
through the establishment of standards and requirements for
the electronic transmission of certain health information.
SEC. 252. ADMINISTRATIVE SIMPLIFICATION.
(a) IN GENERAL.—Title XI (42 U.S.C. 1301 et seq.)
is amended by adding at the end the following:
137
‘‘PART C—ADMINISTRATIVE SIMPLIFICATION
‘‘SEC. 1171. DEFINITIONS.
‘‘For purposes of this part:
‘‘(1) CLEARINGHOUSE.—The term ‘clearinghouse’
means a public or private entity that—
‘‘(A) processes or facilitates the processing
of nonstandard data elements of health informa-
tion into standard data elements; or
‘‘(B) provides the means by which persons
may meet the requirements of this part.
‘‘(2) CODE SET.—The term ‘code set’ means any
set of codes used for encoding data elements, such as
tables of terms, medical concepts, medical diagnostic
codes, or medical procedure codes.
‘‘(3) 
HEALTH
CARE
PROVIDER.—The 
term
‘health care provider’ includes a provider of services
(as defined in section 1861(u)), a provider of medical
or other health services (as defined in section
1861(s)), and any other person furnishing health care
services or supplies.
‘‘(4) HEALTH INFORMATION.—The term ‘health
information’ means any information, whether oral or
recorded in any form or medium that—
‘‘(A) is created or received by a health care
provider, health plan, public health authority,
138
employer, life insurer, school or university, or
clearinghouse; and
‘‘(B) relates to the past, present, or future
physical or mental health or condition of an in-
dividual, the provision of health care to an indi-
vidual, or the past, present, or future payment
for the provision of health care to an individual.
‘‘(5) HEALTH
PLAN.—The term ‘health plan’
means a plan which provides, or pays the cost of,
health benefits. Such term includes the following, or
any combination thereof:
‘‘(A) Part A or part B of the medicare pro-
gram under title XVIII.
‘‘(B) The medicaid program under title
XIX.
‘‘(C) A medicare supplemental policy (as
defined in section 1882(g)(1)).
‘‘(D) Coverage issued as a supplement to li-
ability insurance.
‘‘(E) General liability insurance.
‘‘(F) Worker’s compensation or similar in-
surance.
‘‘(G) Automobile or automobile medical-
payment insurance.
139
‘‘(H) A long-term care policy, including a
nursing home fixed indemnity policy (unless the
Secretary determines that such a policy does not
provide sufficiently comprehensive coverage of a
benefit so that the policy should be treated as a
health plan).
‘‘(I) A hospital or fixed indemnity income-
protection policy.
‘‘(J) An employee welfare benefit plan, as
defined in section 3(1) of the Employee Retire-
ment Income Security Act of 1974 (29 U.S.C.
1002(1)), but only to the extent the plan is estab-
lished or maintained for the purpose of provid-
ing health benefits and has 50 or more partici-
pants (as defined in section 3(7) of such Act).
‘‘(K) An employee welfare benefit plan or
any other arrangement which is established or
maintained for the purpose of offering or provid-
ing health benefits to the employees of 2 or more
employers.
‘‘(L) The health care program for active
military personnel under title 10, United States
Code.
‘‘(M) The veterans health care program
under chapter 17 of title 38, United States Code.
140
‘‘(N) The Civilian Health and Medical Pro-
gram of the Uniformed Services (CHAMPUS),
as defined in section 1073(4) of title 10, United
States Code.
‘‘(O) The Indian health service program
under the Indian Health Care Improvement Act
(25 U.S.C. 1601 et seq.).
‘‘(P) The Federal Employees Health Benefit
Plan under chapter 89 of title 5, United States
Code.
‘‘(Q) Such other plan or arrangement as the
Secretary determines is a health plan.
‘‘(6) INDIVIDUALLY
IDENTIFIABLE
HEALTH
IN-
FORMATION.—The term ‘individually identifiable
health information’ means any information, includ-
ing demographic information collected from an indi-
vidual, that—
‘‘(A) is created or received by a health care
provider, health plan, employer, or clearing-
house; and
‘‘(B) relates to the past, present, or future
physical or mental health or condition of an in-
dividual, the provision of health care to an indi-
vidual, or the past, present, or future payment
141
for the provision of health care to an individual,
and—
‘‘(i) identifies the individual; or
‘‘(ii) with respect to which there is a
reasonable basis to believe that the informa-
tion can be used to identify the individual.
‘‘(7) STANDARD.—The term ‘standard’, when
used with reference to a data element of health infor-
mation or a transaction referred to in section
1173(a)(1), means any such data element or trans-
action that meets each of the standards and imple-
mentation specifications adopted or established by the
Secretary with respect to the data element or trans-
action under sections 1172 through 1174.
‘‘(8) STANDARD
SETTING
ORGANIZATION.—The
term ‘standard setting organization’ means a stand-
ard setting organization accredited by the American
National Standards Institute, including the National
Council for Prescription Drug Programs, that devel-
ops standards for information transactions, data ele-
ments, or any other standard that is necessary to, or
will facilitate, the implementation of this part.
142
‘‘SEC. 1172. GENERAL REQUIREMENTS FOR ADOPTION OF
STANDARDS.
‘‘(a) APPLICABILITY.—Any standard adopted under
this part shall apply to the following persons:
‘‘(1) A health plan.
‘‘(2) A clearinghouse.
‘‘(3) A health care provider who transmits any
health information in electronic form in connection
with a transaction referred to in section 1173(a)(1).
‘‘(b) REDUCTION OF COSTS.—Any standard adopted
under this part shall be consistent with the objective of re-
ducing the administrative costs of providing and paying
for health care.
‘‘(c) ROLE OF STANDARD SETTING ORGANIZATIONS.—
‘‘(1) IN GENERAL.—Except as provided in para-
graph (2), any standard adopted under this part
shall be developed or modified by a standard setting
organization.
‘‘(2) SPECIAL RULES.—
‘‘(A) DIFFERENT
STANDARDS.—The Sec-
retary may adopt a standard that is different
from any standard developed or modified by a
standard setting organization, if—
‘‘(i) the different standard will sub-
stantially reduce administrative costs to
143
health care providers and health plans com-
pared to the alternatives; and
‘‘(ii) the standard is promulgated in
accordance with the rulemaking procedures
of subchapter III of chapter 5 of title 5,
United States Code.
‘‘(B) NO STANDARD BY STANDARD SETTING
ORGANIZATION.—If no standard setting organi-
zation has adopted or modified any standard re-
lating to a standard that the Secretary is au-
thorized or required to adopt under this part—
‘‘(i) paragraph (1) shall not apply;
and
‘‘(ii) subsection (f) shall apply.
‘‘(d) IMPLEMENTATION SPECIFICATIONS.—The Sec-
retary shall establish specifications for implementing each
of the standards adopted under this part.
‘‘(e) PROTECTION OF TRADE SECRETS.—Except as
otherwise required by law, a standard adopted under this
part shall not require disclosure of trade secrets or confiden-
tial commercial information by a person required to comply
with this part.
‘‘(f) ASSISTANCE TO THE SECRETARY.—In complying
with the requirements of this part, the Secretary shall rely
on the recommendations of the Health Information Advi-
144
sory Committee established under section 1179 and shall
consult with appropriate Federal and State agencies and
private organizations. The Secretary shall publish in the
Federal Register the recommendations of the Health Infor-
mation Advisory Committee regarding the adoption of a
standard under this part.
‘‘(g) APPLICATION
TO MODIFICATIONS
OF STAND-
ARDS.—This section shall apply to a modification to a
standard (including an addition to a standard) adopted
under section 1174(b) in the same manner as it applies to
an initial standard adopted under section 1174(a).
‘‘SEC. 1173. STANDARDS FOR INFORMATION TRANSACTIONS
AND DATA ELEMENTS.
‘‘(a) STANDARDS
TO
ENABLE
ELECTRONIC
EX-
CHANGE.—
‘‘(1) IN GENERAL.—The Secretary shall adopt
standards for transactions, and data elements for
such transactions, to enable health information to be
exchanged electronically, that are—
‘‘(A) appropriate for the financial and ad-
ministrative transactions described in paragraph
(2); and
‘‘(B) related to other financial and admin-
istrative transactions determined appropriate by
the Secretary consistent with the goals of im-
145
proving the operation of the health care system
and reducing administrative costs.
‘‘(2) TRANSACTIONS.—The transactions referred
to in paragraph (1)(A) are the following:
‘‘(A) Claims (including coordination of ben-
efits) or equivalent encounter information.
‘‘(B) Claims attachments.
‘‘(C) Enrollment and disenrollment.
‘‘(D) Eligibility.
‘‘(E) Health care payment and remittance
advice.
‘‘(F) Premium payments.
‘‘(G) First report of injury.
‘‘(H) Claims status.
‘‘(I) Referral certification and authoriza-
tion.
‘‘(3) ACCOMMODATION
OF
SPECIFIC
PROVID-
ERS.—The standards adopted by the Secretary under
paragraph (1) shall accommodate the needs of dif-
ferent types of health care providers.
‘‘(b) UNIQUE HEALTH IDENTIFIERS.—
‘‘(1) IN GENERAL.—The Secretary shall adopt
standards providing for a standard unique health
identifier for each individual, employer, health plan,
and health care provider for use in the health care
146
system. In carrying out the preceding sentence for
each health plan and health care provider, the Sec-
retary shall take into account multiple uses for iden-
tifiers and multiple locations and specialty classifica-
tions for health care providers.
‘‘(2) USE
OF
IDENTIFIERS.—The standards
adopted under paragraphs (1) shall specify the pur-
poses for which a unique health identifier may be
used.
‘‘(c) CODE SETS.—
‘‘(1) IN GENERAL.—The Secretary shall adopt
standards that—
‘‘(A) select code sets for appropriate data
elements for the transactions referred to in sub-
section (a)(1) from among the code sets that have
been developed by private and public entities; or
‘‘(B) establish code sets for such data ele-
ments if no code sets for the data elements have
been developed.
‘‘(2) DISTRIBUTION.—The Secretary shall estab-
lish efficient and low-cost procedures for distribution
(including electronic distribution) of code sets and
modifications made to such code sets under section
1174(b).
147
‘‘(d) SECURITY STANDARDS FOR HEALTH INFORMA-
TION.—
‘‘(1) 
SECURITY
STANDARDS.—The 
Secretary
shall adopt security standards that—
‘‘(A) take into account—
‘‘(i) the technical capabilities of record
systems used to maintain health informa-
tion;
‘‘(ii) the costs of security measures;
‘‘(iii) the need for training persons
who have access to health information;
‘‘(iv) the value of audit trails in com-
puterized record systems; and
‘‘(v) the needs and capabilities of small
health care providers and rural health care
providers (as such providers are defined by
the Secretary); and
‘‘(B) ensure that a clearinghouse, if it is
part of a larger organization, has policies and
security procedures which isolate the activities of
the clearinghouse with respect to processing in-
formation in a manner that prevents unauthor-
ized access to such information by such larger
organization.
148
‘‘(2) SAFEGUARDS.—Each person described in
section 1172(a) who maintains or transmits health
information shall maintain reasonable and appro-
priate administrative, technical, and physical safe-
guards—
‘‘(A) to ensure the integrity and confiden-
tiality of the information;
‘‘(B) to protect against any reasonably an-
ticipated—
‘‘(i) threats or hazards to the security
or integrity of the information; and
‘‘(ii) unauthorized uses or disclosures
of the information; and
‘‘(C) otherwise to ensure compliance with
this part by the officers and employees of such
person.
‘‘(e) PRIVACY STANDARDS
FOR HEALTH INFORMA-
TION.—The Secretary shall adopt standards with respect to
the privacy of individually identifiable health information.
Such standards shall include standards concerning at least
the following:
‘‘(1) The rights of an individual who is a subject
of such information.
‘‘(2) The procedures to be established for the exer-
cise of such rights.
149
‘‘(3) The uses and disclosures of such informa-
tion that are authorized or required.
‘‘(f) ELECTRONIC SIGNATURE.—
‘‘(1) IN GENERAL.—The Secretary, in coordina-
tion with the Secretary of Commerce, shall adopt
standards specifying procedures for the electronic
transmission and authentication of signatures, com-
pliance with which shall be deemed to satisfy Federal
and State statutory requirements for written signa-
tures with respect to the transactions referred to in
subsection (a)(1).
‘‘(2) PAYMENTS
FOR
SERVICES
AND
PRE-
MIUMS.—Nothing in this part shall be construed to
prohibit payment for health care services or health
plan premiums by debit, credit, payment card or
numbers, or other electronic means.
‘‘(g) TRANSFER
OF INFORMATION AMONG HEALTH
PLANS.—The Secretary shall adopt standards for transfer-
ring among health plans appropriate standard data ele-
ments needed for the coordination of benefits, the sequential
processing of claims, and other data elements for individ-
uals who have more than one health plan.
‘‘SEC. 1174. TIMETABLES FOR ADOPTION OF STANDARDS.
‘‘(a) INITIAL STANDARDS.—The Secretary shall carry
out section 1173 not later than 18 months after the date
150
of the enactment of this part, except that standards relating
to claims attachments shall be adopted not later than 30
months after such date.
‘‘(b) ADDITIONS
AND MODIFICATIONS
TO STAND-
ARDS.—
‘‘(1) IN GENERAL.—Except as provided in para-
graph (2), the Secretary shall review the standards
adopted under section 1173, and shall adopt modi-
fications to the standards (including additions to the
standards), as determined appropriate, but not more
frequently than once every 6 months. Any addition or
modification to a standard shall be completed in a
manner which minimizes the disruption and cost of
compliance.
‘‘(2) SPECIAL RULES.—
‘‘(A) FIRST
12-MONTH
PERIOD.—Except
with respect to additions and modifications to
code sets under subparagraph (B), the Secretary
may not adopt any modification to a standard
adopted under this part during the 12-month pe-
riod beginning on the date the standard is ini-
tially adopted, unless the Secretary determines
that the modification is necessary in order to
permit compliance with the standard.
151
‘‘(B) ADDITIONS
AND
MODIFICATIONS
TO
CODE SETS.—
‘‘(i) IN GENERAL.—The Secretary shall
ensure that procedures exist for the routine
maintenance, testing, enhancement, and ex-
pansion of code sets.
‘‘(ii) ADDITIONAL
RULES.—If a code
set is modified under this subsection, the
modified code set shall include instructions
on how data elements of health information
that were encoded prior to the modification
may be converted or translated so as to pre-
serve the informational value of the data
elements that existed before the modifica-
tion. Any modification to a code set under
this subsection shall be implemented in a
manner that minimizes the disruption and
cost of complying with such modification.
‘‘SEC. 1175. REQUIREMENTS.
‘‘(a) CONDUCT OF TRANSACTIONS BY PLANS.—
‘‘(1) IN GENERAL.—If a person desires to con-
duct a transaction referred to in section 1173(a)(1)
with a health plan as a standard transaction—
‘‘(A) the health plan may not refuse to con-
duct such transaction as a standard transaction;
152
‘‘(B) the health plan may not delay such
transaction, or otherwise adversely affect, or at-
tempt to adversely affect, the person or the trans-
action on the ground that the transaction is a
standard transaction; and
‘‘(C) the information transmitted and re-
ceived in connection with the transaction shall be
in the form of standard data elements of health
information.
‘‘(2) 
SATISFACTION
OF
REQUIREMENTS.—A
health plan may satisfy the requirements under para-
graph (1) by—
‘‘(A) directly transmitting and receiving
standard data elements of health information; or
‘‘(B) submitting nonstandard data elements
to a clearinghouse for processing into standard
data elements and transmission by the clearing-
house, and receiving standard data elements
through the clearinghouse.
‘‘(3) TIMETABLE FOR COMPLIANCE.—Paragraph
(1) shall not be construed to require a health plan to
comply with any standard, implementation specifica-
tion, or modification to a standard or specification
adopted or established by the Secretary under sections
1172 through 1174 at any time prior to the date on
153
which the plan is required to comply with the stand-
ard or specification under subsection (b).
‘‘(b) COMPLIANCE WITH STANDARDS.—
‘‘(1) INITIAL COMPLIANCE.—
‘‘(A) IN
GENERAL.—Not later than 24
months after the date on which an initial stand-
ard or implementation specification is adopted
or established under sections 1172 and 1173,
each person to whom the standard or implemen-
tation specification applies shall comply with the
standard or specification.
‘‘(B) SPECIAL RULE FOR SMALL HEALTH
PLANS.—In the case of a small health plan,
paragraph (1) shall be applied by substituting
‘36 months’ for ‘24 months’. For purposes of this
subsection, the Secretary shall determine the
plans that qualify as small health plans.
‘‘(2) COMPLIANCE
WITH
MODIFIED
STAND-
ARDS.—If the Secretary adopts a modification to a
standard or implementation specification under this
part, each person to whom the standard or implemen-
tation specification applies shall comply with the
modified standard or implementation specification at
such time as the Secretary determines appropriate,
taking into account the time needed to comply due to
154
the nature and extent of the modification. The time
determined appropriate under the preceding sentence
may not be earlier than the last day of the 180-day
period beginning on the date such modification is
adopted. The Secretary may extend the time for com-
pliance for small health plans, if the Secretary deter-
mines that such extension is appropriate.
‘‘SEC. 1176. GENERAL PENALTY FOR FAILURE TO COMPLY
WITH REQUIREMENTS AND STANDARDS.
‘‘(a) GENERAL PENALTY.—
‘‘(1) IN GENERAL.—Except as provided in sub-
section (b), the Secretary shall impose on any person
who violates a provision of this part a penalty of not
more than $100 for each such violation, except that
the total amount imposed on the person for all viola-
tions of an identical requirement or prohibition dur-
ing a calendar year may not exceed $25,000.
‘‘(2) PROCEDURES.—The provisions of section
1128A (other than subsections (a) and (b) and the
second sentence of subsection (f)) shall apply to the
imposition of a civil money penalty under this sub-
section in the same manner as such provisions apply
to the imposition of a penalty under such section
1128A.
‘‘(b) LIMITATIONS.—
156
‘‘(i) NO PENALTY.—The period referred
to in subparagraph (A)(ii) may be extended
as determined appropriate by the Secretary
based on the nature and extent of the failure
to comply.
‘‘(ii) ASSISTANCE.—If the Secretary
determines that a person failed to comply
because the person was unable to comply,
the Secretary may provide technical assist-
ance to the person during the period de-
scribed in subparagraph (A)(ii). Such as-
sistance shall be provided in any manner
determined appropriate by the Secretary.
‘‘(4) REDUCTION.—In the case of a failure to
comply which is due to reasonable cause and not to
willful neglect, any penalty under subsection (a) that
is not entirely waived under paragraph (3) may be
waived to the extent that the payment of such penalty
would be excessive relative to the compliance failure
involved.
‘‘SEC. 1177. WRONGFUL DISCLOSURE OF INDIVIDUALLY
IDENTIFIABLE HEALTH INFORMATION.
‘‘(a) OFFENSE.—A person who knowingly and in vio-
lation of this part—
157
‘‘(1) uses or causes to be used a unique health
identifier;
‘‘(2) obtains individually identifiable health in-
formation relating to an individual; or
‘‘(3) discloses individually identifiable health in-
formation to another person,
shall be punished as provided in subsection (b).
‘‘(b) PENALTIES.—A person described in subsection (a)
shall—
‘‘(1) be fined not more than $50,000, imprisoned
not more than 1 year, or both;
‘‘(2) if the offense is committed under false pre-
tenses, be fined not more than $100,000, imprisoned
not more than 5 years, or both; and
‘‘(3) if the offense is committed with intent to
sell, transfer, or use individually identifiable health
information for commercial advantage, personal gain,
or malicious harm, fined not more than $250,000,
imprisoned not more than 10 years, or both.
‘‘SEC. 1178. EFFECT ON STATE LAW.
‘‘(a) GENERAL EFFECT.—
‘‘(1) GENERAL
RULE.—Except as provided in
paragraph (2), a provision or requirement under this
part, or a standard or implementation specification
adopted or established under sections 1172 through
158
1174, shall supersede any contrary provision of State
law, including a provision of State law that requires
medical or health plan records (including billing in-
formation) to be maintained or transmitted in writ-
ten rather than electronic form.
‘‘(2) EXCEPTIONS.—A provision or requirement
under this part, or a standard or implementation
specification adopted or established under sections
1172 through 1174, shall not supersede a contrary
provision of State law, if the provision of State law—
‘‘(A) imposes requirements, standards, or
implementation specifications that are more
stringent than the requirements, standards, or
implementation specifications under this part
with respect to the privacy of individually iden-
tifiable health information; or
‘‘(B) is a provision the Secretary deter-
mines—
‘‘(i) is necessary to prevent fraud and
abuse, or for other purposes; or
‘‘(ii) addresses controlled substances.
‘‘(b) PUBLIC HEALTH REPORTING.—Nothing in this
part shall be construed to invalidate or limit the authority,
power, or procedures established under any law providing
for the reporting of disease or injury, child abuse, birth,
159
or death, public health surveillance, or public health inves-
tigation or intervention.
‘‘SEC. 1179. HEALTH INFORMATION ADVISORY COMMITTEE.
‘‘(a) ESTABLISHMENT.—There is established a com-
mittee to be known as the Health Information Advisory
Committee (in this section referred to as the ‘committee’).
‘‘(b) DUTIES.—The committee shall—
‘‘(1) provide assistance to the Secretary in com-
plying with the requirements imposed on the Sec-
retary under this part;
‘‘(2) study the issues related to the adoption of
uniform data standards for patient medical record
information and the electronic exchange of such infor-
mation;
‘‘(3) report to the Secretary not later than 4
years after the date of the enactment of this part rec-
ommendations and legislative proposals for such
standards and electronic exchange; and
‘‘(4) generally be responsible for advising the
Secretary and the Congress on the status of the imple-
mentation of this part.
‘‘(c) MEMBERSHIP.—
‘‘(1) IN GENERAL.—The committee shall consist
of 15 members of whom—
‘‘(A) 3 shall be appointed by the President;
160
‘‘(B) 6 shall be appointed by the Speaker of
the House of Representatives after consultation
with the minority leader of the House of Rep-
resentatives; and
‘‘(C) 6 shall be appointed by the President
pro tempore of the Senate after consultation with
the minority leader of the Senate.
The appointments of the members shall be made not
later than 60 days after the date of the enactment of
this part. The President shall designate 1 member as
the Chair.
‘‘(2) EXPERTISE.—The membership of the com-
mittee shall consist of individuals who are of recog-
nized standing and distinction in the areas of infor-
mation systems, information networking and integra-
tion, consumer health, health care financial manage-
ment, or privacy, and who possess the demonstrated
capacity to discharge the duties imposed on the com-
mittee.
‘‘(3) TERMS.—Each member of the committee
shall be appointed for a term of 5 years, except that
the members first appointed shall serve staggered
terms such that the terms of not more than 3 members
expire at one time.
161
‘‘(4) INITIAL MEETING.—Not later than 30 days
after the date on which a majority of the members
have been appointed, the committee shall hold its first
meeting.
‘‘(d) REPORTS.—Not later than 1 year after the date
of the enactment of this part, and annually thereafter, the
committee shall submit to the Congress, and make public,
a report regarding—
‘‘(1) the extent to which persons required to com-
ply with this part are cooperating in implementing
the standards adopted under this part;
‘‘(2) the extent to which such entities are meeting
the privacy and security standards adopted under
this part and the types of penalties assessed for non-
compliance with such standards;
‘‘(3) whether the Federal and State Governments
are receiving information of sufficient quality to meet
their responsibilities under this part;
‘‘(4) any problems that exist with respect to im-
plementation of this part; and
‘‘(5) the extent to which timetables under this
part are being met.’’.
(b) CONFORMING AMENDMENTS.—
162
(1) REQUIREMENT FOR MEDICARE PROVIDERS.—
Section 1866(a)(1) (42 U.S.C. 1395cc(a)(1)) is
amended—
(A) by striking ‘‘and’’ at the end of sub-
paragraph (P);
(B) by striking the period at the end of sub-
paragraph (Q) and inserting ‘‘; and’’; and
(C) by inserting immediately after subpara-
graph (Q) the following new subparagraph:
‘‘(R) to contract only with a clearinghouse (as
defined in section 1171) that meets each standard and
implementation specification adopted or established
under part C of title XI on or after the date on which
the clearinghouse is required to comply with the
standard or specification.’’.
(2) TITLE HEADING.—Title XI (42 U.S.C. 1301
et seq.) is amended by striking the title heading and
inserting the following:
‘‘TITLE XI—GENERAL PROVISIONS, PEER RE-
VIEW, AND ADMINISTRATIVE SIMPLIFICA-
TION’’.