I 114th CONGRESS 1st Session H. R. 2549 IN THE HOUSE OF REPRESENTATIVES May 21, 2015 Mrs. McMorris Rodgers introduced the following bill; which was referred to the Committee on Energy and Commerce A BILL To amend the HITECH Act with respect to accessing, sharing, and using health data for research purposes.

1. Accessing, sharing, and using health data for research purposes (a) In general The HITECH Act (title XIII of division A of Public Law 111–5 ) is amended by adding at the end of subtitle D of such Act ( 42 U.S.C. 17921 et seq. ) the following: 4 Accessing, sharing, and using health data for research purposes 13441. References In this part: (a) The Rule References to the Rule refer to part 160 or part 164, as appropriate, of title 45, Code of Federal Regulations (or any successor regulation). (b) Part 164 References to a specified section of part 164 , refer to such specified section of part 164 of title 45, Code of Federal Regulations (or any successor section). 13442. Defining health data research as part of health care operations (a) In general Subject to subsection (b), the Secretary shall revise or clarify the rule to allow the use and disclosure of protected health information by a covered entity for research purposes, including studies whose purpose is to obtain generalizable knowledge, to be treated as the use and disclosure of such information for health care operations described in subparagraph (1) of the definition of health care operations in section 164.501 of part 164. (b) Modifications to rules for disclosures for health care operations In applying section 164.506 of part 164 to the disclosure of protected health information described in subsection (a)— (1) the Secretary shall revise or clarify the Rule so that the disclosure may be made by the covered entity to only— (A) another covered entity for health care operations (as defined in such section 164.501 of part 164); (B) a business associate that has entered into a contract under section 164.504(e) of part 164 with a disclosing covered entity to perform health care operations; or (C) a business associate that has entered into a contract under section 164.504(e) of part 164 for the purpose of data aggregation (as defined in such section 164.501 of part 164); and (2) the Secretary shall further revise or clarify the Rule so that the limitation specified by section 164.506(c)(4) of part 164 does not apply to disclosures that are described by subsection (a). (c) Rule of construction This section shall not be construed as prohibiting or restricting a use or disclosure of protected health information for research purposes that is otherwise permitted under part 164. 13443. Treating disclosures of protected health information for research similarly to disclosures of such information for public health purposes (a) Remuneration The Secretary shall revise or clarify the Rule so that disclosures of protected health information for research purposes are not subject to the limitation on remuneration described in section 164.502(a)(5)(ii)(B)(2)(ii) of part 164. (b) Permitted uses and disclosures The Secretary shall revise or clarify the Rule so that research activities, including comparative research activities, related to the quality, safety, or effectiveness of a product or activity that is regulated by the Food and Drug Administration are included as public health activities for purposes of which a covered entity may disclose protected health information to a person described in section 164.512(b)(1)(iii) of part 164. 13444. Permitting remote access to protected health information by researchers The Secretary shall revise or clarify the Rule so that subparagraph (B) of section 164.512(i)(1)(ii) of part 164 (prohibiting the removal of protected health information by a researcher) shall not prohibit remote access to health information by a researcher so long as— (1) appropriate security and privacy safeguards are maintained by the covered entity and the researcher; and (2) the protected health information is not copied or otherwise retained by the researcher. 13445. Allowing one-time authorization of use and disclosure of protected health information for research purposes (a) In general The Secretary shall revise or clarify the Rule to specify that an authorization for the use or disclosure of protected health information, with respect to an individual, for future research purposes shall be deemed to contain a sufficient description of the purpose of the use or disclosure if the authorization— (1) sufficiently describes the purposes such that it would be reasonable for the individual to expect that the protected health information could be used or disclosed for such future research; (2) either— (A) states that the authorization will expire on a particular date or on the occurrence of a particular event; or (B) states that the authorization will remain valid unless and until it is revoked by the individual; and (3) provides instruction to the individual on how to revoke such authorization at any time. (b) Revocation of authorization The Secretary shall revise or clarify the Rule to specify that, if an individual revokes an authorization for future research purposes such as is described by subsection (a), the covered entity may not make any further uses or disclosures based on that authorization, except, as provided in paragraph (b)(5) of section 164.508 of part 164, to the extent that the covered entity has taken action in reliance on the authorization. . (b) Revision of regulations Not later than 12 months after the date of the enactment of this Act, the Secretary of Health and Human Services shall revise and clarify the provisions of title 45, Code of Federal Regulations, for consistency with part 4 of subtitle D of the HITECH Act, as added by subsection (a).