To amend the HITECH Act with respect to accessing, sharing, and using health data for research purposes.

SECTION 1. ACCESSING, SHARING, AND USING HEALTH DATA FOR RESEARCH 
              PURPOSES.

    (a) In General.--The HITECH Act (title XIII of division A of Public 
Law 111-5) is amended by adding at the end of subtitle D of such Act 
(42 U.S.C. 17921 et seq.) the following:

   ``PART 4--ACCESSING, SHARING, AND USING HEALTH DATA FOR RESEARCH 
                                PURPOSES

``SEC. 13441. REFERENCES.

    ``In this part:
    ``(a) The Rule.--References to `the Rule' refer to part 160 or part 
164, as appropriate, of title 45, Code of Federal Regulations (or any 
successor regulation).
    ``(b) Part 164.--References to a specified section of `part 164', 
refer to such specified section of part 164 of title 45, Code of 
Federal Regulations (or any successor section).

``SEC. 13442. DEFINING HEALTH DATA RESEARCH AS PART OF HEALTH CARE 
              OPERATIONS.

    ``(a) In General.--Subject to subsection (b), the Secretary shall 
revise or clarify the rule to allow the use and disclosure of protected 
health information by a covered entity for research purposes, including 
studies whose purpose is to obtain generalizable knowledge, to be 
treated as the use and disclosure of such information for health care 
operations described in subparagraph (1) of the definition of health 
care operations in section 164.501 of part 164.
    ``(b) Modifications to Rules for Disclosures for Health Care 
Operations.--In applying section 164.506 of part 164 to the disclosure 
of protected health information described in subsection (a)--
            ``(1) the Secretary shall revise or clarify the Rule so 
        that the disclosure may be made by the covered entity to only--
                    ``(A) another covered entity for health care 
                operations (as defined in such section 164.501 of part 
                164);
                    ``(B) a business associate that has entered into a 
                contract under section 164.504(e) of part 164 with a 
                disclosing covered entity to perform health care 
                operations; or
                    ``(C) a business associate that has entered into a 
                contract under section 164.504(e) of part 164 for the 
                purpose of data aggregation (as defined in such section 
                164.501 of part 164); and
            ``(2) the Secretary shall further revise or clarify the 
        Rule so that the limitation specified by section 164.506(c)(4) 
        of part 164 does not apply to disclosures that are described by 
        subsection (a).
    ``(c) Rule of Construction.--This section shall not be construed as 
prohibiting or restricting a use or disclosure of protected health 
information for research purposes that is otherwise permitted under 
part 164.

``SEC. 13443. TREATING DISCLOSURES OF PROTECTED HEALTH INFORMATION FOR 
              RESEARCH SIMILARLY TO DISCLOSURES OF SUCH INFORMATION FOR 
              PUBLIC HEALTH PURPOSES.

    ``(a) Remuneration.--The Secretary shall revise or clarify the Rule 
so that disclosures of protected health information for research 
purposes are not subject to the limitation on remuneration described in 
section 164.502(a)(5)(ii)(B)(2)(ii) of part 164.
    ``(b) Permitted Uses and Disclosures.--The Secretary shall revise 
or clarify the Rule so that research activities, including comparative 
research activities, related to the quality, safety, or effectiveness 
of a product or activity that is regulated by the Food and Drug 
Administration are included as public health activities for purposes of 
which a covered entity may disclose protected health information to a 
person described in section 164.512(b)(1)(iii) of part 164.

``SEC. 13444. PERMITTING REMOTE ACCESS TO PROTECTED HEALTH INFORMATION 
              BY RESEARCHERS.

    ``The Secretary shall revise or clarify the Rule so that 
subparagraph (B) of section 164.512(i)(1)(ii) of part 164 (prohibiting 
the removal of protected health information by a researcher) shall not 
prohibit remote access to health information by a researcher so long 
as--
            ``(1) appropriate security and privacy safeguards are 
        maintained by the covered entity and the researcher; and
            ``(2) the protected health information is not copied or 
        otherwise retained by the researcher.

``SEC. 13445. ALLOWING ONE-TIME AUTHORIZATION OF USE AND DISCLOSURE OF 
              PROTECTED HEALTH INFORMATION FOR RESEARCH PURPOSES.

    ``(a) In General.--The Secretary shall revise or clarify the Rule 
to specify that an authorization for the use or disclosure of protected 
health information, with respect to an individual, for future research 
purposes shall be deemed to contain a sufficient description of the 
purpose of the use or disclosure if the authorization--
            ``(1) sufficiently describes the purposes such that it 
        would be reasonable for the individual to expect that the 
        protected health information could be used or disclosed for 
        such future research;
            ``(2) either--
                    ``(A) states that the authorization will expire on 
                a particular date or on the occurrence of a particular 
                event; or
                    ``(B) states that the authorization will remain 
                valid unless and until it is revoked by the individual; 
                and
            ``(3) provides instruction to the individual on how to 
        revoke such authorization at any time.
    ``(b) Revocation of Authorization.--The Secretary shall revise or 
clarify the Rule to specify that, if an individual revokes an 
authorization for future research purposes such as is described by 
subsection (a), the covered entity may not make any further uses or 
disclosures based on that authorization, except, as provided in 
paragraph (b)(5) of section 164.508 of part 164, to the extent that the 
covered entity has taken action in reliance on the authorization.''.
    (b) Revision of Regulations.--Not later than 12 months after the 
date of the enactment of this Act, the Secretary of Health and Human 
Services shall revise and clarify the provisions of title 45, Code of 
Federal Regulations, for consistency with part 4 of subtitle D of the 
HITECH Act, as added by subsection (a).

Summary: This bill amends the HITECH Act to require the Department of Health and Human Services (HHS) to revise or clarify the privacy rule established under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to allow the use and disclosure of protected health information for research purposes without the individual's authorization, approval from an Institutional Review Board or Privacy Board, or representations from the researcher regarding limited use of the information. These disclosures may only be made to entities subject to HIPAA for health care operations or to business associates that are complying with the privacy rule for health care operations or data aggregation. There is no limitation on payments for these disclosures. Currently, payment is limited to the cost to prepare and transmit the information. An individual's protected health information may be disclosed without the authorization or agreement of the individual for research related to a product or activity that is regulated by the Food and Drug Administration.  A researcher is allowed remote access to protected health information if security and privacy safeguards are maintained and the researcher does not retain the information. An individual's authorization to use protected health information for future research is sufficient for a research purpose if the authorization reasonably describes the research and provides instruction to the individual on how to revoke the authorization.