TASK DEFINITION: In this task, you are given text for US Congressional and California state bills, your task is to generate a summary for this bill.
PROBLEM: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Medical Device Cybersecurity Act of 
2017''.

SEC. 2. CYBERSECURITY FOR MEDICAL DEVICES.

    (a) In General.--Chapter V of the Federal Food, Drug, and Cosmetic 
Act (21 U.S.C. 351 et seq.) is amended by inserting after section 520 
(21 U.S.C. 360j) the following--

``SEC. 520A. CYBERSECURITY FOR DEVICES.

    ``(a) Definitions.--In this section:
            ``(1) Cyber device.--The term `cyber device' means any 
        device that has network or Internet connectivity (such as near 
        field communication (NFC), Bluetooth, or WiFi), connects to an 
        external storage device or external media (such as a universal 
        serial bus (USB) or a compact disk), or has any other cyber 
        capability.
            ``(2) Cybersecurity fix or update.--The term `cybersecurity 
        fix or update' means any modification to a cyber device that 
        addresses a software, firmware, or hardware error or known 
        vulnerability, or a security update, and does not change the 
        therapeutic or diagnostic function of the device.
    ``(b) Transparency of Risk Prior to Marketing.--
            ``(1) Report card.--
                    ``(A) In general.--The Secretary, in coordination 
                with the entities described in subparagraph (B), shall 
                develop a report card for indicating the cybersecurity 
                functions of cyber devices. The report card shall 
                contain the contents described in paragraph (2) and be 
                disclosed in accordance with paragraph (3).
                    ``(B) Coordination.--The entities described in this 
                subparagraph are the following:
                            ``(i) The National Institute of Standards 
                        and Technology.
                            ``(ii) The Secretary of Homeland Security.
                            ``(iii) The National Coordination Office 
                        supporting the Networking and Information 
                        Technology Research and Development Program.
                            ``(iv) The Federal Trade Commission.
                            ``(v) Any other relevant agency, or 
                        cybersecurity or medical device industry group, 
                        as determined by the Secretary.
            ``(2) Contents of report card.--Each report card shall 
        contain each of the following:
                    ``(A) Information pertaining to all essential 
                elements described in the most recent version of the 
                Manufacturer Disclosure Statement for Medical Device 
                Security, as set forth by the Healthcare Information 
                and Management Systems Society and the National 
                Electrical Manufacturers Association.
                    ``(B) A traceability matrix, accepted by the 
                Secretary, that--
                            ``(i) redacts content that is confidential, 
                        as determined by the Secretary; and
                            ``(ii) establishes design components and 
                        traces such components to design compensating 
                        controls.
                    ``(C) A description of any manufacturer 
                compensating controls that--
                            ``(i) effectively address known common 
                        vulnerabilities and exposures; and
                            ``(ii) provide providers with industry 
                        standard compensating controls for improving 
                        cybersecurity.
                    ``(D) A description of--
                            ``(i) any cybersecurity evaluation 
                        conducted on the device, including any testing, 
                        validation, or verification of the device;
                            ``(ii) who conducted such evaluation; and
                            ``(iii) the results of such evaluation.
                    ``(E) A cybersecurity risk assessment conducted by 
                the manufacturer, or a third party, explaining the risk 
                of the device to patient safety and clinical hazards.
                    ``(F) An indication of whether the device is 
                capable of being remotely accessed. If the device is 
                capable of being remotely accessed, an indication of 
                any security measures and access protocols the device 
                has in place to secure such access.
            ``(3) Disclosure of report card.--
                    ``(A) Clearance or approval.--The manufacturer of 
                any cyber device shall include the report card in any 
                notification to the Secretary under section 510(k) or 
                any application for premarket approval under section 
                515(c), as applicable.
                    ``(B) Public accessibility.--
                            ``(i) In general.--The Secretary shall 
                        provide a copy of the report card to any entity 
                        described in clause (ii) that submits a request 
                        for such copy to the Secretary.
                            ``(ii) Entities permitted access.--An 
                        entity described in this clause is--
                                    ``(I) any health care industry 
                                entity, consisting of any provider, 
                                device manufacturer, the Federal 
                                Government, health care information 
                                security researchers, and health care 
                                academia; and
                                    ``(II) any entity determined by the 
                                Secretary to have a valid interest in 
                                the report card.
                    ``(C) Updated report card.--For as long as the 
                cyber device receives technical support from the 
                manufacturer or any other third party authorized by the 
                manufacturer, the manufacturer shall submit to the 
                Secretary an annual update to the report card.
    ``(c) Protecting Remote Access to Managed Solutions.--
            ``(1) In general.--A manufacturer of a cyber device shall:
                    ``(A) In order to remotely access such device after 
                selling, or otherwise transferring ownership of, the 
                device, obtain consent for such access from the 
                provider owning or operating the device and from any 
                patient on which the device is used. Such consent may 
                be in the form of an agreement entered into between the 
                provider and the manufacturer at the time the device is 
                sold to the provider, and may be for the manufacturer 
                to remotely access the device at times specified in 
                such agreement or by an agreement between the 
                manufacturer and provider entered into thereafter. In 
                the case of an agreement described in the previous 
                sentence, consent of the patient may be obtained 
                through the provider notifying the patient of such 
                agreement.
                    ``(B) For any cyber device that the manufacturer 
                may remotely access in accordance with subparagraph 
                (A):
                            ``(i) Notify the provider when the 
                        manufacturer accesses the device remotely, 
                        including the name of the person with such 
                        access, the kinds of tasks that can be 
                        performed through such access, and the software 
                        used to access the device. Such notification 
                        can be in the form of an audit log described in 
                        clause (ii) if the audit log is readily 
                        available to the provider.
                            ``(ii) Maintain an audit log for each time 
                        the manufacturer accesses the device remotely 
                        and make such log accessible to the provider.
                    ``(C) Except as provided in paragraph (2), for any 
                cyber device that has the capability to be accessed 
                remotely by the manufacturer or any other entity:
                            ``(i) Implement multi-factor authentication 
                        for accessing any cyber capability of the 
                        device.
                            ``(ii) Secure data in motion and data at 
                        rest with data encryption, and other best 
                        practices, approved by the National Institute 
                        of Standards and Technology.
                            ``(iii) Install automated tools to track 
                        access, or identify attempts at unauthorized 
                        access, to any cyber capability of the device.
                            ``(iv) Adopt whitelisting approaches and 
                        changeable passwords for accessing any cyber 
                        capability of the device.
                            ``(v) Comply with the remote access 
                        provisions recommended by the National 
                        Institute of Standards and Technology, in the 
                        document entitled `Security for Telecommuting 
                        and Broadband Communications (NIST Special 
                        Publication 800-46)', published in August 2002.
            ``(2) Exceptions.--A manufacturer may submit a petition to 
        the Secretary to exempt a cyber device from any requirement 
        under paragraph (1)(C). The Secretary may grant such an 
        exemption if it determines that the manufacturer can prove the 
        exemption would pose not more than a minimal risk to patient 
        health, minimal risk to privacy, and minimal risk of a cyber 
        vulnerability.
    ``(d) Cybersecurity Fixes or Updates.--
            ``(1) Re-clearance or reapproval.--Unless at the request of 
        the Secretary due to a unique and extenuating circumstance, any 
        cybersecurity fix or update shall not require a new 
        notification under section 510(k) or application for premarket 
        approval under section 515(c).
            ``(2) Free cybersecurity fixes or updates.--A manufacturer 
        of a cyber device shall provide any cybersecurity fix or update 
        to the device free of charge until--
                    ``(A) the date on which any agreement to provide 
                such fixes or updates, entered into between the 
                manufacturer (or a third party authorized by the 
                manufacturer) and a provider, expires; or
                    ``(B) if no agreement described in subparagraph (A) 
                is in effect, the date that is 10 years after the date 
                on which the manufacturer discontinues marketing the 
                device.
    ``(e) End-of-Life Device.--Not later than 90 days after a 
manufacturer declares that it will no longer sell a cyber device, the 
manufacturer of such device shall--
            ``(1) shall provide any provider owning or operating the 
        device with the report card, as most recently updated under 
        subsection (b)(3)(C);
            ``(2) to the extent practicable, inform any provider owning 
        or operating the device that the manufacturer will no longer be 
        manufacturing such device;
            ``(3) provide notice to any provider owning or operating 
        the device of the date on which the last cybersecurity fix or 
        update will be provided by the manufacturer;
            ``(4) notify the Secretary of such declaration; and
            ``(5) provide any provider owning or operating the device 
        with the following information related to the device:
                    ``(A) Compensating controls on how to securely 
                configure the cyber device if the device stays in 
                operation past the date on which the manufacturer stops 
                providing cybsecurity fixes or updates under subsection 
                (d)(2).
                    ``(B) Documentation on secure preparation for 
                recycling and disposal of the device.
                    ``(C) Specific guidance regarding supporting 
                infrastructure architecture, including network 
                segmentation and device isolation requirements.
                    ``(D) Instructions on how to delete any personally 
                identifiable information, protected health information, 
                or other site-specific sensitive data such as 
                configuration files.
    ``(f) Applicability.--This section shall not apply with respect to 
any cyber device for which, prior to the enactment of the Medical 
Device Cybersecurity Act of 2017, a notification was submitted under 
section 510(k), or for which an application for premarket approval was 
submitted under section 515(c).''.
    (b) Enforcement.--Section 301 of the Federal Food, Drug, and 
Cosmetic Act (21 U.S.C. 331) is amended by adding at the end the 
following:
    ``(eee) The failure to comply with subsection (b), (c), (d), or (e) 
of section 520A.''.
    (c) Expansion of ICS-CERT Responsibilities.--
            (1) Definitions.--In this subsection:
                    (A) Cyber device.--The term ``cyber device'' has 
                the meaning given the term in section 520A of the 
                Federal Food, Drug, and Cosmetic Act, as added by 
                subsection (a).
                    (B) ICS-CERT.--The term ``ICS-CERT'' means the 
                Industrial Control Systems Cyber Emergency Response 
                Team of the National Cybersecurity and Communications 
                Integration Center established under section 227 of the 
                Homeland Security Act of 2002 (6 U.S.C. 148).
                    (C) Under secretary.--The term ``Under Secretary'' 
                means the Under Secretary appointed under section 
                103(a)(1)(H) of the Homeland Security Act of 2002 (6 
                U.S.C. 113(a)(1)(H)).
            (2) Expansion.--Not later than 180 days after the date of 
        enactment of this Act, the Under Secretary shall expand the 
        duties and mission of ICS-CERT to include--
                    (A) investigating cybersecurity vulnerabilities of 
                cyber devices that may cause harm to human life or 
                significant misuse of personal health information, as 
                determined necessary by ICS-CERT or at the request of 
                the Under Secretary; and
                    (B) coordinating device-specific responses to 
                cybersecurity incidents and vulnerabilities with 
                respect to cyber devices.
            (3) Consultation.--In carrying out paragraph (2), the Under 
        Secretary shall consult with relevant agencies within the Food 
        and Drug Administration, the Department of Health and Human 
        Services, the National Institute of Standards and Technology, 
        the National Coordination Office for Networking and Information 
        Technology Research and Development, the Federal Trade 
        Commission, and experts in the cybersecurity and medical device 
        industries.
            (4) Coordinated disclosure.--Not later than 6 months after 
        the date of enactment of this Act, the Secretary of Homeland 
        Security shall issue rules relating to the coordinated 
        disclosure of controlled and uncontrolled cybersecurity 
        vulnerabilities of cyber devices, which shall--
                    (A) outline the roles and responsibilities of ICS-
                CERT and manufacturers and providers of cyber devices;
                    (B) provide timelines for all required actions; and
                    (C) provide for the enforcement of cooperation 
                between ICS-CERT and manufacturers and providers of 
                cyber devices.
            (5) Report.--Not later than 1 year after the date of 
        enactment of this Act, the Under Secretary shall submit to 
        Congress a report detailing the expanded duties and mission of 
        ICS-CERT under paragraph (2).

SOLUTION: Medical Device Cybersecurity Act of 2017 This bill amends the Federal Food, Drug, and Cosmetic Act to require the Food and Drug Administration (FDA), in coordination with others,&nbsp;to create a cybersecurity report card for devices that have network or Internet connectivity, connect to an external drive or external media, or have any other cyber capability. Report cards must contain specified information, including: (1) information pertaining to the essential elements described in the most recent version of the Manufacturer Disclosure Statement for Medical Device Security, (2) a cybersecurity risk assessment conducted by the manufacturer or third party, and (3) whether the device is capable of being accessed remotely. A cyber device manufacturer must include&nbsp;a report card in any premarket notification or application for premarket approval. The&nbsp;FDA shall provide a copy of a device's report card&nbsp;if requested&nbsp;by a health care industry entity or an entity with a valid interest in the report card.&nbsp; The bill establishes procedures, including notifications to&nbsp;providers and patients,&nbsp;for manufacturers&nbsp;when cyber devices are&nbsp;remotely accessed or no longer going to be sold. Fixes and updates to cyber devices must be free of charge for specified time periods. The bill expands the responsibilities of the Department of Homeland Security's&nbsp;Industrial Control Systems Cyber Emergency Response Team to include investigating cybersecurity vulnerabilities of cyber devices that may cause harm to human life or the significant misuse of personal health information, and coordinating device-specific responses.

PROBLEM: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Small Business Health Tax Credit 
Act''.

SEC. 2. SMALL BUSINESS TAX CREDIT FOR 50 PERCENT OF HEALTH PREMIUMS.

    (a) In General.--Subpart D of part IV of subchapter A of chapter 1 
of the Internal Revenue Code of 1986 (relating to business-related 
credits) is amended by adding at the end the following:

``SEC. 45G. EMPLOYEE HEALTH INSURANCE EXPENSES.

    ``(a) General Rule.--For purposes of section 38, in the case of a 
qualified small employer, the employee health insurance expenses credit 
determined under this section is an amount equal to the applicable 
percentage of the amount paid by the taxpayer during the taxable year 
for qualified employee health insurance expenses.
    ``(b) Applicable Percentage.--For purposes of subsection (a), the 
applicable percentage is equal to--
            ``(1) 50 percent in the case of an employer with less than 
        26 qualified employees,
            ``(2) 40 percent in the case of an employer with more than 
        25 but less than 36 qualified employees, and
            ``(3) 30 percent in the case of an employer with more than 
        35 but less than 51 qualified employees.
    ``(c) Per Employee Dollar Limitation.--The amount of qualified 
employee health insurance expenses taken into account under subsection 
(a) with respect to any qualified employee for any taxable year shall 
not exceed the maximum employer contribution for self-only coverage or 
family coverage (as applicable) determined under section 8906(a) of 
title 5, United States Code, for the calendar year in which such 
taxable year begins.
    ``(d) Definitions and Special Rules.--For purposes of this 
section--
            ``(1) Qualified small employer.--
                    ``(A) In general.--The term `qualified small 
                employer' means any small employer which provides 
                eligibility for health insurance coverage (after any 
                waiting period (as defined in section 9801(b)(4))) to 
                all qualified employees of the employer.
                    ``(B) Small employer.--
                            ``(i) In general.--For purposes of this 
                        paragraph, the term `small employer' means, 
                        with respect to any calendar year, any employer 
                        if such employer employed an average of not 
                        less than 2 and not more than 50 qualified 
                        employees on business days during either of the 
                        2 preceding calendar years. For purposes of the 
                        preceding sentence, a preceding calendar year 
                        may be taken into account only if the employer 
                        was in existence throughout such year.
                            ``(ii) Employers not in existence in 
                        preceding year.--In the case of an employer 
                        which was not in existence throughout the 1st 
                        preceding calendar year, the determination 
                        under clause (i) shall be based on the average 
                        number of qualified employees that it is 
                        reasonably expected such employer will employ 
                        on business days in the current calendar year.
            ``(2) Qualified employee health insurance expenses.--
                    ``(A) In general.--The term `qualified employee 
                health insurance expenses' means any amount paid by an 
                employer for health insurance coverage to the extent 
                such amount is attributable to coverage provided to any 
                employee while such employee is a qualified employee.
                    ``(B) Exception for amounts paid under salary 
                reduction arrangements.--No amount paid or incurred for 
                health insurance coverage pursuant to a salary 
                reduction arrangement shall be taken into account under 
                subparagraph (A).
                    ``(C) Health insurance coverage.--The term `health 
                insurance coverage' has the meaning given such term by 
                paragraph (1) of section 9832(b) (determined by 
                disregarding the last sentence of paragraph (2) of such 
                section).
            ``(3) Qualified employee.--The term `qualified employee' 
        means an employee of an employer who, with respect to any 
period, is not provided health insurance coverage under--
                    ``(A) a health plan of the employee's spouse,
                    ``(B) title XVIII, XIX, or XXI of the Social 
                Security Act,
                    ``(C) chapter 17 of title 38, United States Code,
                    ``(D) chapter 55 of title 10, United States Code,
                    ``(E) chapter 89 of title 5, United States Code, or
                    ``(F) any other provision of law.
            ``(4) Employee--The term `employee'--
                    ``(A) means any individual, with respect to any 
                calendar year, who is reasonably expected to receive at 
                least $5,000 of compensation from the employer during 
                such year,
                    ``(B) does not include an employee within the 
                meaning of section 401(c)(1), and
                    ``(C) includes a leased employee within the meaning 
                of section 414(n).
            ``(5) Compensation.--The term `compensation' means amounts 
        described in section 6051(a)(3).
    ``(e) Certain Rules Made Applicable.--For purposes of this section, 
rules similar to the rules of section 52 shall apply.
    ``(f) Denial of Double Benefit.--No deduction or credit under any 
other provision of this chapter shall be allowed with respect to 
qualified employee health insurance expenses taken into account under 
subsection (a).''.
    (b) Credit To Be Part of General Business Credit.--Section 38(b) of 
the Internal Revenue Code of 1986 (relating to current year business 
credit) is amended by striking ``plus'' at the end of paragraph (14), 
by striking the period at the end of paragraph (15) and inserting ``, 
plus'', and by adding at the end the following:
            ``(16) the employee health insurance expenses credit 
        determined under section 45G.''.
    (c) Credit Allowed Against Minimum Tax.--
            (1) In general.--Subsection (c) of section 38 of the 
        Internal Revenue Code of 1986 (relating to limitation based on 
        amount of tax) is amended by redesignating paragraph (4) as 
        paragraph (5) and by inserting after paragraph (3) the 
        following new paragraph:
            ``(4) Special rules for employee health insurance credit.--
                    ``(A) In general.--In the case of the employee 
                health insurance credit--
                            ``(i) this section and section 39 shall be 
                        applied separately with respect to the credit, 
                        and
                            ``(ii) in applying paragraph (1) to the 
                        credit--
                                    ``(I) the amounts in subparagraphs 
                                (A) and (B) thereof shall be treated as 
                                being zero, and
                                    ``(II) the limitation under 
                                paragraph (1) (as modified by subclause 
                                (I)) shall be reduced by the credit 
                                allowed under subsection (a) for the 
                                taxable year (other than the employee 
                                health insurance credit).
                    ``(B) Employee health insurance credit.--For 
                purposes of this subsection, the term `employee health 
                insurance credit' means the credit allowable under 
                subsection (a) by reason of section 45G(a).''.
            (2) Conforming amendments.--
                    (A) Subclause (II) of section 38(c)(2)(A)(ii) of 
                such Code is amended by inserting ``or the employee 
                health insurance credit'' after ``employee credit''.
                    (B) Subclause (II) of section 38(c)(3)(A)(ii) of 
                such Code is amended by inserting ``or the employee 
                health insurance credit'' after ``employee credit''.
    (d) No Carrybacks.--Subsection (d) of section 39 of the Internal 
Revenue Code of 1986 (relating to carryback and carryforward of unused 
credits) is amended by adding at the end the following:
            ``(11) No carryback of section 45g credit before effective 
        date.--No portion of the unused business credit for any taxable 
        year which is attributable to the employee health insurance 
        expenses credit determined under section 45G may be carried 
        back to a taxable year ending before the date of the enactment 
        of section 45G.''.
    (e) Clerical Amendment.--The table of sections for subpart D of 
part IV of subchapter A of chapter 1 of the Internal Revenue Code of 
1986 is amended by adding at the end the following:

                              ``Sec. 45G. Employee health insurance 
                                        expenses.''.
    (f) Employer Outreach.--The Internal Revenue Service shall, in 
conjunction with the Small Business Administration, develop materials 
and implement an educational program to ensure that business personnel 
are aware of--
            (1) the eligibility criteria for the tax credit provided 
        under section 45G of the Internal Revenue Code of 1986 (as 
        added by this section),
            (2) the methods to be used in calculating such credit,
            (3) the documentation needed in order to claim such credit, 
        and
            (4) any available health plan purchasing alliances 
        established under title II,
so that the maximum number of eligible businesses may claim the tax 
credit.
    (g) Effective Date.--The amendments made by this section shall 
apply to amounts paid or incurred in taxable years beginning after the 
date of the enactment of this Act.

SOLUTION: Small Business Health Tax Credit Act - Amends the Internal Revenue Code to allow small business employers (employers with between two and 50 employees) an income tax credit of between 30 to 50 percent (depending upon the number of employees) of the amount paid for employee health insurance, subject to a dollar limitation for each employee. Allows the employer to apply such credit against its minimum tax liability. Directs the Internal Revenue Service, in conjunction with the Small Business Administration, to educate small business personnel about this tax credit.

PROBLEM: SECTION 1. BAN ON DISCLOSURE OF MEDICAL QUALITY ASSURANCE INFORMATION.

    Subsection (a) of section 5705 of title 38, United States Code, is 
amended--
            (1) by inserting ``(1)'' after ``(a)''; and
            (2) by adding at the end the following:
    ``(2)(A) Except as provided in subsection (b), no part of any 
medical quality assurance record or document described in subsection 
(a)(1) may be subject to discovery or admitted into evidence in any 
judicial or administrative proceeding.
    ``(B) An individual who reviews or creates medical quality 
assurance records or documents for the Department or who participates 
in any proceeding that reviews or creates such records or documents may 
not be permitted or required to testify in any judicial or 
administrative proceeding with respect to such records or documents or 
with respect to any finding, recommendation, evaluation, opinion, or 
action taken by such person in connection with such records or 
documents except as provided in this section.''.

SEC. 2. DISCLOSURE AUTHORITY.

    (a) Clarification of Coverage.--Subsection (b)(1) of section 5705 
of title 38, United States Code, is amended by striking out ``or 
document'' in the matter above subparagraph (A) and inserting in lieu 
thereof ``, document, or testimony''.
    (b) Disclosure for Professional Use.--Such subsection is further 
amended by adding at the end the following:
            ``(E) In an administrative or judicial proceeding commenced 
        by a criminal or civil law enforcement agency or 
        instrumentality referred to in subparagraph (C), but only 
        concerning the subject of such proceeding.
            ``(F) To a governmental board or agency or to a 
        professional health care society or organization, if such 
        record or document is needed by the board, agency, society, or 
        organization to issue a professional license or credential to 
        or to monitor the compliance with professional standards of any 
        health care provider who is or was an employee of the 
        Department.
            ``(G) To a hospital, medical center, or other institution 
        that provides health care services, if such record or document 
        is needed by the institution to assess the professional 
        qualifications of any health care provider who is or was an 
        employee of the Department and who has applied for or been 
        granted authority or employment to provide health care services 
        in or on behalf of such institution.
            ``(H) To an administrative or judicial proceeding commenced 
        by a present or former Department health care provider 
        concerning the termination, suspension or limitation of the 
        clinical privileges of such health care provider, or concerning 
        any adverse action involving such health care provider, but 
        only to the extent that such records or documents relate to the 
        clinical conduct or performance of the individual who has 
        commenced the action.''.
    (c) Removal of Identities.--Subsection (b)(2) of such section is 
amended by striking out ``if disclosure'' and all that follows through 
``personal privacy'' and inserting in lieu thereof ``subparagraphs 
(1)(A) and (1)(B) of this subsection''.

SEC. 3. LIMITATION ON DISCLOSURE.

    Paragraph (3) of section 5705(b) of title 38, United States Code, 
is amended to read as follows:
    ``(3) A person or entity having possession of, or access to, 
information, records, or documents, or testimony relating thereto, that 
is subject to the provisions of this section may not disclose such 
information, records, or documents, or any testimony relating thereto, 
in any manner or for any purpose except for a purpose as provided in 
this subsection. No person or entity to whom a record or document has 
been disclosed under this subsection shall make further disclosure of 
such record or document except for a purpose provided in this 
subsection.''.

SEC. 4. ACCESS TO RECORDS.

    Subsection (b) of section 5705 of title 38, United States Code, is 
amended by adding at the end the following:
    ``(7) Medical quality assurance records and documents described in 
subsection (a) which are subject to section 552a of title 5 may not be 
disclosed in accordance with that section except to the extent that 
such disclosure is also authorized under this section.
    ``(8) Medical quality assurance records or documents described in 
subsection (a) which are also subject to section 552a of title 5--
            ``(A) shall not be subject to the access provisions of such 
        section 552a to the extent that such access would reveal the 
        identities of participants in the quality assurance process 
        which generated the records or documents; and
            ``(B) are not subject to the amendment provisions of such 
        section 552a.
    ``(9) Medical quality assurance records and documents described in 
subsection (a) may not be made available to any person under section 
552 of title 5.''.

SEC. 5. REGULATIONS.

    Subsection (d)(2) of section 5705 of title 38, United States Code, 
is amended by striking out ``specified in'' and inserting in lieu 
thereof ``accomplished in accordance with''.

SOLUTION:
Prohibits Department of Veterans Affairs medical quality assurance records from being subject to discovery or admitted into evidence in any judicial or administrative proceeding.  Prohibits an individual who participates in the production of such records from being required to testify at such a proceeding. 
Allows testimony concerning such records (currently, only the records or documents themselves) to be disclosed to Federal agencies for certain limited purposes (licensing, accreditation).  Specifies additional uses for which such information may be disclosed. 
Includes information and testimony related to such records within certain disclosure limitation provisions. 
Prohibits the disclosure of such records by the Department as public information to the extent that such disclosure would reveal the identities of the participants in the quality assurance process which generated the records or documents.