To amend the Health Information Technology for Economic and Clinical Health Act to require the Secretary of Health and Human Services to consider certain recognized security practices of covered entities and business associates when making certain determinations, and for other purposes.

Bill: 116-hr-7898
Sponsor: full_name: Rep. Burgess, Michael C. [R-TX-26]
Introduced: 2020-07-31
Policy area: Health
Subjects: Computers and information technology

Fraud offenses and financial crimes

Government studies and investigations

Health information and medical records
Latest action: action_date: 2021-01-05
text: Became Public Law No: 116-321.

Summaries:
action_date: 2020-07-31
action_desc: Introduced in House
text: <p>This bill authorizes the Office of the Inspector General of the Department of Health and Human Services to obtain information, assistance, and other support from federal agencies when investigating claims of information blocking by developers of, or entities offering, health information technologies.</p> <p><i>Information blocking</i> refers to a practice that is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information, such as the imposition of fees that make exchanging this information cost prohibitive.</p> </p>

action_date: 2020-12-09
action_desc: Passed House
text: <p>This bill addresses health information technology provisions concerning cybersecurity practices and information blocking.</p> <p>The Department of Health and Human Services (HHS) may reduce fines and penalties for violations of certain federal privacy standards for health information if an entity subject to those standards has adopted particular cybersecurity practices.</p> <p>This bill also authorizes HHS's Office of the Inspector General to obtain information, assistance, and other support from federal agencies when investigating claims of information blocking by developers of, or entities offering, health information technologies.</p> <p><i>Information blocking</i> refers to a practice that is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information, such as the imposition of fees that make exchanging this information cost prohibitive.</p> </p>

action_date: 2020-12-19
action_desc: Passed Senate
text: <p>This bill addresses health information technology provisions concerning cybersecurity practices and information blocking.</p> <p>The Department of Health and Human Services (HHS) may reduce fines and penalties for violations of certain federal privacy standards for health information if an entity subject to those standards has adopted particular cybersecurity practices.</p> <p>This bill also authorizes HHS's Office of the Inspector General to obtain information, assistance, and other support from federal agencies when investigating claims of information blocking by developers of, or entities offering, health information technologies.</p> <p><i>Information blocking</i> refers to a practice that is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information, such as the imposition of fees that make exchanging this information cost prohibitive.</p> </p>

action_date: 2021-01-05
action_desc: Public Law
text: <p>This bill addresses health information technology provisions concerning cybersecurity practices and information blocking.</p> <p>The Department of Health and Human Services (HHS) may reduce fines and penalties for violations of certain federal privacy standards for health information if an entity subject to those standards has adopted particular cybersecurity practices.</p> <p>This bill also authorizes HHS's Office of the Inspector General to obtain information, assistance, and other support from federal agencies when investigating claims of information blocking by developers of, or entities offering, health information technologies.</p> <p><i>Information blocking</i> refers to a practice that is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information, such as the imposition of fees that make exchanging this information cost prohibitive.</p> </p>

tv_txt: I 116th CONGRESS 2d Session H. R. 7898 IN THE HOUSE OF REPRESENTATIVES July 31, 2020 Mr. Burgess (for himself and Mr. Welch ) introduced the following bill; which was referred to the Committee on Energy and Commerce A BILL To amend title XXX of the Public Health Services Act to provide for a technical correction to provide the Inspector General of the Department of Health and Human Service certain authorities with respect to investigations of information blocking, and for other purposes.

1. Technical correction (a) In general Section 3022(b) of the Public Health Service Act ( 42 U.S.C. 300jj–52(b) ) is amended by adding at the end the following new paragraph: (4) Application of authorities under Inspector General Act of 1978 In carrying out this subsection, the Inspector General shall have the same authorities as provided under section 6 of the Inspector General Act of 1978 (5 U.S.C. App.). . (b) Effective date The amendment made by subsection (a) shall take effect as if included in the enactment of the 21st Century Cures Act ( Public Law 114–255 ).

tv_txt: I 116th CONGRESS 2d Session H. R. 7898 IN THE HOUSE OF REPRESENTATIVES AN ACT To amend the Health Information Technology for Economic and Clinical Health Act to require the Secretary of Health and Human Services to consider certain recognized security practices of covered entities and business associates when making certain determinations, and for other purposes.

1. Recognition of security practices Part 1 of subtitle D of the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17931 et seq.) is amended by adding at the end the following: 13412. Recognition of security practices (a) In general Consistent with the authority of the Secretary under sections 1176 and 1177 of the Social Security Act, when making determinations relating to fines under such section 1176 (as amended by section 13410) or such section 1177, decreasing the length and extent of an audit under section 13411, or remedies otherwise agreed to by the Secretary, the Secretary shall consider whether the covered entity or business associate has adequately demonstrated that it had, for not less than the previous 12 months, recognized security practices in place that may— (1) mitigate fines under section 1176 of the Social Security Act (as amended by section 13410); (2) result in the early, favorable termination of an audit under section 13411; and (3) mitigate the remedies that would otherwise be agreed to in any agreement with respect to resolving potential violations of the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title) between the covered entity or business associate and the Department of Health and Human Services. (b) Definition and miscellaneous provisions (1) Recognized security practices The term recognized security practices means the standards, guidelines, best practices, methodologies, procedures, and processes developed under section 2(c)(15) of the National Institute of Standards and Technology Act, the approaches promulgated under section 405(d) of the Cybersecurity Act of 2015, and other programs and processes that address cybersecurity and that are developed, recognized, or promulgated through regulations under other statutory authorities. Such practices shall be determined by the covered entity or business associate, consistent with the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title). (2) Limitation Nothing in this section shall be construed as providing the Secretary authority to increase fines under section 1176 of the Social Security Act (as amended by section 13410), or the length, extent or quantity of audits under section 13411, due to a lack of compliance with the recognized security practices. (3) No liability for nonparticipation Subject to paragraph (4), nothing in this section shall be construed to subject a covered entity or business associate to liability for electing not to engage in the recognized security practices defined by this section. (4) Rule of construction Nothing in this section shall be construed to limit the Secretary’s authority to enforce the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title), or to supersede or conflict with an entity or business associate’s obligations under the HIPAA Security rule. . 2. Technical correction (a) In general Section 3022(b) of the Public Health Service Act ( 42 U.S.C. 300jj–52(b) ) is amended by adding at the end the following new paragraph: (4) Application of authorities under Inspector General Act of 1978 In carrying out this subsection, the Inspector General shall have the same authorities as provided under section 6 of the Inspector General Act of 1978 (5 U.S.C. App.). . (b) Effective date The amendment made by subsection (a) shall take effect as if included in the enactment of the 21st Century Cures Act ( Public Law 114–255 ).

Passed the House of Representatives December 9, 2020. Cheryl L. Johnson, Clerk.

tv_txt: I One Hundred Sixteenth Congress of the United States of America At the Second Session Begun and held at the City of Washington on Friday, the third day of January, two thousand and twenty H. R. 7898 AN ACT To amend the Health Information Technology for Economic and Clinical Health Act to require the Secretary of Health and Human Services to consider certain recognized security practices of covered entities and business associates when making certain determinations, and for other purposes.

1. Recognition of security practices Part 1 of subtitle D of the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17931 et seq.) is amended by adding at the end the following: 13412. Recognition of security practices (a) In general Consistent with the authority of the Secretary under sections 1176 and 1177 of the Social Security Act, when making determinations relating to fines under such section 1176 (as amended by section 13410) or such section 1177, decreasing the length and extent of an audit under section 13411, or remedies otherwise agreed to by the Secretary, the Secretary shall consider whether the covered entity or business associate has adequately demonstrated that it had, for not less than the previous 12 months, recognized security practices in place that may— (1) mitigate fines under section 1176 of the Social Security Act (as amended by section 13410); (2) result in the early, favorable termination of an audit under section 13411; and (3) mitigate the remedies that would otherwise be agreed to in any agreement with respect to resolving potential violations of the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title) between the covered entity or business associate and the Department of Health and Human Services. (b) Definition and miscellaneous provisions (1) Recognized security practices The term recognized security practices means the standards, guidelines, best practices, methodologies, procedures, and processes developed under section 2(c)(15) of the National Institute of Standards and Technology Act, the approaches promulgated under section 405(d) of the Cybersecurity Act of 2015, and other programs and processes that address cybersecurity and that are developed, recognized, or promulgated through regulations under other statutory authorities. Such practices shall be determined by the covered entity or business associate, consistent with the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title). (2) Limitation Nothing in this section shall be construed as providing the Secretary authority to increase fines under section 1176 of the Social Security Act (as amended by section 13410), or the length, extent or quantity of audits under section 13411, due to a lack of compliance with the recognized security practices. (3) No liability for nonparticipation Subject to paragraph (4), nothing in this section shall be construed to subject a covered entity or business associate to liability for electing not to engage in the recognized security practices defined by this section. (4) Rule of construction Nothing in this section shall be construed to limit the Secretary’s authority to enforce the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title), or to supersede or conflict with an entity or business associate’s obligations under the HIPAA Security rule. . 2. Technical correction (a) In general Section 3022(b) of the Public Health Service Act ( 42 U.S.C. 300jj–52(b) ) is amended by adding at the end the following new paragraph: (4) Application of authorities under Inspector General Act of 1978 In carrying out this subsection, the Inspector General shall have the same authorities as provided under section 6 of the Inspector General Act of 1978 (5 U.S.C. App.). . (b) Effective date The amendment made by subsection (a) shall take effect as if included in the enactment of the 21st Century Cures Act ( Public Law 114–255 ).

Speaker of the House of Representatives. Vice President of the United States and President of the Senate.

tv_txt: II 116th CONGRESS 2d Session H. R. 7898 IN THE SENATE OF THE UNITED STATES December 10, 2020 Received AN ACT To amend the Health Information Technology for Economic and Clinical Health Act to require the Secretary of Health and Human Services to consider certain recognized security practices of covered entities and business associates when making certain determinations, and for other purposes.

1. Recognition of security practices Part 1 of subtitle D of the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17931 et seq.) is amended by adding at the end the following: 13412. Recognition of security practices (a) In general Consistent with the authority of the Secretary under sections 1176 and 1177 of the Social Security Act, when making determinations relating to fines under such section 1176 (as amended by section 13410) or such section 1177, decreasing the length and extent of an audit under section 13411, or remedies otherwise agreed to by the Secretary, the Secretary shall consider whether the covered entity or business associate has adequately demonstrated that it had, for not less than the previous 12 months, recognized security practices in place that may— (1) mitigate fines under section 1176 of the Social Security Act (as amended by section 13410); (2) result in the early, favorable termination of an audit under section 13411; and (3) mitigate the remedies that would otherwise be agreed to in any agreement with respect to resolving potential violations of the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title) between the covered entity or business associate and the Department of Health and Human Services. (b) Definition and miscellaneous provisions (1) Recognized security practices The term recognized security practices means the standards, guidelines, best practices, methodologies, procedures, and processes developed under section 2(c)(15) of the National Institute of Standards and Technology Act, the approaches promulgated under section 405(d) of the Cybersecurity Act of 2015, and other programs and processes that address cybersecurity and that are developed, recognized, or promulgated through regulations under other statutory authorities. Such practices shall be determined by the covered entity or business associate, consistent with the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title). (2) Limitation Nothing in this section shall be construed as providing the Secretary authority to increase fines under section 1176 of the Social Security Act (as amended by section 13410), or the length, extent or quantity of audits under section 13411, due to a lack of compliance with the recognized security practices. (3) No liability for nonparticipation Subject to paragraph (4), nothing in this section shall be construed to subject a covered entity or business associate to liability for electing not to engage in the recognized security practices defined by this section. (4) Rule of construction Nothing in this section shall be construed to limit the Secretary’s authority to enforce the HIPAA Security rule (part 160 of title 45 Code of Federal Regulations and subparts A and C of part 164 of such title), or to supersede or conflict with an entity or business associate’s obligations under the HIPAA Security rule. . 2. Technical correction (a) In general Section 3022(b) of the Public Health Service Act ( 42 U.S.C. 300jj–52(b) ) is amended by adding at the end the following new paragraph: (4) Application of authorities under Inspector General Act of 1978 In carrying out this subsection, the Inspector General shall have the same authorities as provided under section 6 of the Inspector General Act of 1978 (5 U.S.C. App.). . (b) Effective date The amendment made by subsection (a) shall take effect as if included in the enactment of the 21st Century Cures Act ( Public Law 114–255 ).

Passed the House of Representatives December 9, 2020. Cheryl L. Johnson, Clerk.