In this task, you are given text for US Congressional and California state bills, your task is to generate a summary for this bill.

[EX Q]: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Cyber Crime Protection Security 
Act''.

SEC. 2. ORGANIZED CRIMINAL ACTIVITY IN CONNECTION WITH UNAUTHORIZED 
              ACCESS TO PERSONALLY IDENTIFIABLE INFORMATION.

    Section 1961(1) of title 18, United States Code, is amended by 
inserting ``section 1030 (relating to fraud and related activity in 
connection with computers) if the act is a felony,'' before ``section 
1084''.

SEC. 3. PENALTIES FOR FRAUD AND RELATED ACTIVITY IN CONNECTION WITH 
              COMPUTERS.

    Section 1030(c) of title 18, United States Code, is amended to read 
as follows:
    ``(c) The punishment for an offense under subsection (a) or (b) of 
this section is--
            ``(1) a fine under this title or imprisonment for not more 
        than 20 years, or both, in the case of an offense under 
        subsection (a)(1) of this section;
            ``(2)(A) except as provided in subparagraph (B), a fine 
        under this title or imprisonment for not more than 3 years, or 
        both, in the case of an offense under subsection (a)(2); or
            ``(B) a fine under this title or imprisonment for not more 
        than ten years, or both, in the case of an offense under 
        paragraph (a)(2) of this section, if--
                    ``(i) the offense was committed for purposes of 
                commercial advantage or private financial gain;
                    ``(ii) the offense was committed in the furtherance 
                of any criminal or tortious act in violation of the 
                Constitution or laws of the United States, or of any 
                State; or
                    ``(iii) the value of the information obtained, or 
                that would have been obtained if the offense was 
                completed, exceeds $5,000;
            ``(3) a fine under this title or imprisonment for not more 
        than 1 year, or both, in the case of an offense under 
        subsection (a)(3) of this section;
            ``(4) a fine under this title or imprisonment of not more 
        than 20 years, or both, in the case of an offense under 
        subsection (a)(4) of this section;
            ``(5)(A) except as provided in subparagraph (D), a fine 
        under this title, imprisonment for not more than 20 years, or 
        both, in the case of an offense under subsection (a)(5)(A) of 
        this section, if the offense caused--
                    ``(i) loss to 1 or more persons during any 1-year 
                period (and, for purposes of an investigation, 
                prosecution, or other proceeding brought by the United 
                States only, loss resulting from a related course of 
                conduct affecting 1 or more other protected computers) 
                aggregating at least $5,000 in value;
                    ``(ii) the modification or impairment, or potential 
                modification or impairment, of the medical examination, 
                diagnosis, treatment, or care of 1 or more individuals;
                    ``(iii) physical injury to any person;
                    ``(iv) a threat to public health or safety;
                    ``(v) damage affecting a computer used by, or on 
                behalf of, an entity of the United States Government in 
                furtherance of the administration of justice, national 
                defense, or national security; or
                    ``(vi) damage affecting 10 or more protected 
                computers during any 1-year period;
            ``(B) a fine under this title, imprisonment for not more 
        than 10 years, or both, in the case of an offense under 
        subsection (a)(5)(B), if the offense caused a harm provided in 
        clause (i) through (vi) of subparagraph (A) of this subsection;
            ``(C) if the offender attempts to cause or knowingly or 
        recklessly causes death from conduct in violation of subsection 
        (a)(5)(A), a fine under this title, imprisonment for any term 
        of years or for life, or both; or
            ``(D) a fine under this title, imprisonment for not more 
        than 1 year, or both, for any other offense under subsection 
        (a)(5);
            ``(6) a fine under this title or imprisonment for not more 
        than 10 years, or both, in the case of an offense under 
        subsection (a)(6) of this section; or
            ``(7) a fine under this title or imprisonment for not more 
        than 10 years, or both, in the case of an offense under 
        subsection (a)(7) of this section..''.

SEC. 4. TRAFFICKING IN PASSWORDS.

    Section 1030(a) of title 18, United States Code, is amended by 
striking paragraph (6) and inserting the following:
            ``(6) knowingly and with intent to defraud traffics (as 
        defined in section 1029) in--
                    ``(A) any password or similar information or means 
                of access through which a protected computer as defined 
                in subparagraphs (A) and (B) of subsection (e)(2) may 
                be accessed without authorization; or
                    ``(B) any means of access through which a protected 
                computer as defined in subsection (e)(2)(A) may be 
                accessed without authorization.''.

SEC. 5. CONSPIRACY AND ATTEMPTED COMPUTER FRAUD OFFENSES.

    Section 1030(b) of title 18, United States Code, is amended by 
inserting ``for the completed offense'' after ``punished as provided''.

SEC. 6. CRIMINAL AND CIVIL FORFEITURE FOR FRAUD AND RELATED ACTIVITY IN 
              CONNECTION WITH COMPUTERS.

    Section 1030 of title 18, United States Code, is amended by 
striking subsections (i) and (j) and inserting the following:
    ``(i) Criminal Forfeiture.--
            ``(1) The court, in imposing sentence on any person 
        convicted of a violation of this section, or convicted of 
        conspiracy to violate this section, shall order, in addition to 
        any other sentence imposed and irrespective of any provision of 
        State law, that such person forfeit to the United States--
                    ``(A) such person's interest in any property, real 
                or personal, that was used, or intended to be used, to 
                commit or facilitate the commission of such violation; 
                and
                    ``(B) any property, real or personal, constituting 
                or derived from any gross proceeds, or any property 
                traceable to such property, that such person obtained, 
                directly or indirectly, as a result of such violation.
            ``(2) The criminal forfeiture of property under this 
        subsection, including any seizure and disposition of the 
        property, and any related judicial or administrative 
        proceeding, shall be governed by the provisions of section 413 
        of the Comprehensive Drug Abuse Prevention and Control Act of 
        1970 (21 U.S.C. 853), except subsection (d) of that section.
    ``(j) Civil Forfeiture.--
            ``(1) The following shall be subject to forfeiture to the 
        United States and no property right, real or personal, shall 
        exist in them:
                    ``(A) Any property, real or personal, that was 
                used, or intended to be used, to commit or facilitate 
                the commission of any violation of this section, or a 
                conspiracy to violate this section.
                    ``(B) Any property, real or personal, constituting 
                or derived from any gross proceeds obtained directly or 
                indirectly, or any property traceable to such property, 
                as a result of the commission of any violation of this 
                section, or a conspiracy to violate this section.
            ``(2) Seizures and forfeitures under this subsection shall 
        be governed by the provisions in chapter 46 of title 18, United 
        States Code, relating to civil forfeitures, except that such 
        duties as are imposed on the Secretary of the Treasury under 
        the customs laws described in section 981(d) of title 18, 
        United States Code, shall be performed by such officers, agents 
        and other persons as may be designated for that purpose by the 
        Secretary of Homeland Security or the Attorney General.''.

SEC. 7. DAMAGE TO CRITICAL INFRASTRUCTURE COMPUTERS.

    (a) In General.--Chapter 47 of title 18, United States Code, is 
amended by inserting after section 1030 the following:

``SEC. 1030A. AGGRAVATED DAMAGE TO A CRITICAL INFRASTRUCTURE COMPUTER.

    ``(a) Definitions.--In this section--
            ``(1) the terms `computer' and `damage' have the meanings 
        given such terms in section 1030; and
            ``(2) the term `critical infrastructure computer' means a 
        computer that manages or controls systems or assets vital to 
        national defense, national security, national economic 
        security, public health or safety, or any combination of those 
        matters, whether publicly or privately owned or operated, 
        including--
                    ``(A) gas and oil production, storage, and delivery 
                systems;
                    ``(B) water supply systems;
                    ``(C) telecommunication networks;
                    ``(D) electrical power delivery systems;
                    ``(E) finance and banking systems;
                    ``(F) emergency services;
                    ``(G) transportation systems and services; and
                    ``(H) government operations that provide essential 
                services to the public.
    ``(b) Offense.--It shall be unlawful to, during and in relation to 
a felony violation of section 1030, intentionally cause or attempt to 
cause damage to a critical infrastructure computer, and such damage 
results in (or, in the case of an attempt, would, if completed have 
resulted in) the substantial impairment--
            ``(1) of the operation of the critical infrastructure 
        computer; or
            ``(2) of the critical infrastructure associated with the 
        computer.
    ``(c) Penalty.--Any person who violates subsection (b) shall be 
fined under this title, imprisoned for not less than 3 years nor more 
than 20 years, or both.
    ``(d) Consecutive Sentence.--Notwithstanding any other provision of 
law--
            ``(1) a court shall not place on probation any person 
        convicted of a violation of this section;
            ``(2) except as provided in paragraph (4), no term of 
        imprisonment imposed on a person under this section shall run 
        concurrently with any other term of imprisonment, including any 
        term of imprisonment imposed on the person under any other 
        provision of law, including any term of imprisonment imposed 
        for the felony violation section 1030;
            ``(3) in determining any term of imprisonment to be imposed 
        for a felony violation of section 1030, a court shall not in 
        any way reduce the term to be imposed for such crime so as to 
        compensate for, or otherwise take into account, any separate 
        term of imprisonment imposed or to be imposed for a violation 
        of this section; and
            ``(4) a term of imprisonment imposed on a person for a 
        violation of this section may, in the discretion of the court, 
        run concurrently, in whole or in part, only with another term 
        of imprisonment that is imposed by the court at the same time 
        on that person for an additional violation of this section, 
        provided that such discretion shall be exercised in accordance 
        with any applicable guidelines and policy statements issued by 
        the United States Sentencing Commission pursuant to section 994 
        of title 28.''.
    (b) Technical and Conforming Amendment.--The table of sections for 
chapter 47 of title 18, United States Code, is amended by inserting 
after the item relating to section 1030 the following:

``Sec. 1030A. Aggravated damage to a critical infrastructure 
                            computer.''.

SEC. 8. LIMITATION ON ACTIONS INVOLVING UNAUTHORIZED USE.

    Section 1030(e)(6) of title 18, United States Code, is amended by 
striking ``alter;'' and inserting ``alter, but does not include access 
in violation of a contractual obligation or agreement, such as an 
acceptable use policy or terms of service agreement, with an Internet 
service provider, Internet website, or non-government employer, if such 
violation constitutes the sole basis for determining that access to a 
protected computer is unauthorized;''.
[EX A]: Cyber Crime Protection Security Act - Amends the federal criminal code to make fraud in connection with the unauthorized access of personally identifiable information (in electronic or digital form) a predicate for instituting a prosecution for racketeering.

Increases penalties for fraud and related activity in connection with computers.

Expands the prohibition against trafficking in passwords to include trafficking through any means by which a protected computer may be accessed without authorization.

Imposes criminal penalties for attempts and conspiracies to commit fraud and related activity in connection with computers.

Modifies criminal and civil forfeiture provisions, including requiring certain civil forfeiture seizures and forfeitures to be performed by persons designated for that purpose by the Secretary of Homeland Security (DHS) or the Attorney General (DOJ).

 Prohibits, during and in relation to a felony violation of provisions regarding fraud and related activity in connection with computers, intentionally causing or attempting to cause damage to a critical infrastructure computer if such damage results in (or, in the case of an attempt, would, if completed have resulted in) the substantial impairment of the operation of that computer or of the critical infrastructure associated with the computer. Imposes a prison term of between 3 and 20 years, a fine, or both. Prohibits probation for any person convicted of such a violation. Provides for concurrent sentences under specified circumstances.

Excludes from the definition of "exceeds authorized access" for purposes of the prohibition against fraudulent use of computers, access in violation of a contractual obligation or agreement, such as an acceptable use policy or terms of service agreement, with an Internet service provider, Internet website, or nongovernment employer, if such violation constitutes the sole basis for determining that access to a protected computer is unauthorized.

[EX Q]: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Child Support Security Act''.

SEC. 2. NO EFFECT ON RIGHTS AND LIABILITIES.

    Nothing in this Act shall be construed to affect--
            (1) the right of an individual or State to receive any 
        child support payment; or
            (2) the obligation of an individual to pay child support.

SEC. 3. INCLUSION IN INCOME OF AMOUNT OF UNPAID CHILD SUPPORT PAYMENTS.

    (a) In General.--Section 108 of the Internal Revenue Code of 1986 
(relating to discharge of indebtedness income) is amended by adding at 
the end thereof the following new subsection:
    ``(h) Unpaid Child Support Payments.--
            ``(1) In general.--For purposes of this chapter, any 
        taxable unpaid child support payments of a taxpayer for any 
        taxable year shall be treated as amounts includible in gross 
        income of the taxpayer for the taxable year by reason of the 
        discharge of indebtedness of the taxpayer.
            ``(2) Taxable unpaid child support payments.--For purposes 
        of this subsection, the term `taxable unpaid child support 
        payments' means payments--
                    ``(A) which were applicable child support payments 
                which the taxpayer was required to pay under a support 
                instrument for the support of a child of the taxpayer, 
                and
                    ``(B) with respect to which the notice requirements 
                of paragraph (3) are met.
            ``(3) Notice requirements.--
                    ``(A) In general.--During January of the second 
                calendar year following a calendar year in which there 
                begins a taxable year for which a deduction allowed 
                under section 166(f) was claimed, the eligible taxpayer 
                shall send a notice (in such form as the Secretary may 
                prescribe) to the individual who failed to make 
                payments which contains--
                            ``(i) the amount of the applicable child 
                        support payments for such taxable year, and
                            ``(ii) notice that the individual is 
                        required to include such amount in gross income 
                        for the taxable year beginning in the preceding 
                        calendar year.
                    ``(B) Notice by secretary.--If notice cannot be 
                provided under subparagraph (A) because the address is 
                not known to the eligible taxpayer, the Secretary shall 
                send such notice if the address is available to the 
                Secretary.
                    ``(C) Address unknown.--If notice cannot be 
                provided under subparagraph (A) or (B) because there is 
                no known address, no income shall be included in gross 
                income for any taxable year beginning before the 
                calendar year preceding the calendar year in which such 
                notice may be sent.
            ``(4) Subsequent payments.--If any payment required to be 
        included in gross income under paragraph (1) is subsequently 
        made, the amount of such payment shall be allowed as a 
        deduction for the taxable year in which such payment is made.
            ``(5) Definitions.--For purposes of this subsection, the 
        terms `applicable child support payments' and `eligible 
        taxpayer' have the meanings given such terms by section 
        166(f).''
    (b) Effective Date.--The amendments made by this section shall 
apply to taxable years beginning after December 31, 1997.

SEC. 4. ALLOWANCE OF BAD DEBT DEDUCTION FOR UNPAID CHILD SUPPORT 
              PAYMENTS.

    (a) In General.--Section 166 of the Internal Revenue Code of 1986 
(relating to deduction for bad debts) is amended by redesignating 
subsection (f) as subsection (g) and by inserting after subsection (e) 
the following new subsection:
    ``(f) Unpaid Child Support Payments.--
            ``(1) In general.--In the case of any eligible taxpayer who 
        has any applicable child support payments remaining unpaid as 
        of the close of the taxable year--
                    ``(A) subsections (a) and (d) shall not apply to 
                such payments, and
                    ``(B) there shall be allowed as a deduction for 
                such taxable year an amount equal to the amount of such 
                payments.
            ``(2) Per child limitation on deduction.--The aggregate 
        amount allowable as a deduction for any taxable year under 
        paragraph (1) with respect to any child for whom applicable 
        child support payments are required to be paid shall not exceed 
        $5,000.
            ``(3) Eligible taxpayer.--For purposes of this subsection, 
        the term `eligible taxpayer' means an individual--
                    ``(A) whose adjusted gross income for the taxable 
                year does not exceed $50,000,
                    ``(B) with respect to whom the amount of applicable 
                child support payments remaining unpaid as of the close 
                of the taxable year is equal to or greater than $500, 
                and
                    ``(C) who meets the identification requirements of 
                paragraph (5).
            ``(4) Applicable child support payment.--
                    ``(A) In general.--The term `applicable child 
                support payment' means, with respect to any taxable 
                year of the eligible taxpayer--
                            ``(i) any periodic payment of a fixed 
                        amount, or
                            ``(ii) any payment of a medical or 
                        educational expense, insurance premium, or 
                        other similar item,
                which is required to be paid to such taxpayer during 
                such taxable year by an individual under a support 
                instrument meeting the requirements of paragraph (8) 
                for the support of any qualifying child of such 
                individual.
                    ``(B) Qualifying child.--For purposes of this 
                paragraph, the term `qualifying child' means a child of 
                an eligible individual with respect to whom a deduction 
                is allowable under section 151 for the taxable year (or 
                would be so allowable but for paragraph (2) or (4) of 
                section 152(e)).
                    ``(C) Payments must be delinquent for at least 
                entire year.--Any payment described in subparagraph (A) 
                which is required to be made by an individual to an 
                eligible taxpayer shall not be treated as an applicable 
                unpaid child support payment if at least half of the 
                payments which are required to be paid to the eligible 
                taxpayer during the 12-month period ending on the last 
                day of the taxable year are paid. In the case of the 
                1st taxable year to which this subsection applies to 
                payments from any individual, the preceding sentence 
                shall be applied by substituting `24-month' for `12-
                month'.
                    ``(D) Coordination with afdc.--The term `applicable 
                child support payment' shall not include any payment 
                the right to which has been assigned to a State under 
                section 402(a)(26) of the Social Security Act (42 
                U.S.C. 602(a)(26)).
            ``(5) Identification requirements.--The requirements of 
        this paragraph are met if the eligible taxpayer includes on the 
        return claiming the deduction under this subsection the name, 
        address, and taxpayer identification number of--
                    ``(A) each child with respect to whom child support 
                payments to which this subsection applies are required 
                to be paid, and
                    ``(B) the individual who was required to make such 
                child support payments.
        In the case of a failure to provide the information under 
        subparagraph (B), the preceding sentence shall not apply if the 
        eligible taxpayer certifies that any such information is not 
        known.
            ``(6) Cost-of-living adjustments.--In the case of any 
        taxable year beginning after 1998, the $50,000 amount under 
        paragraph (2)(A), the $50,000 amount under paragraph (3)(A), 
        and the $500 amount under paragraph (3)(B) shall each be 
        increased by an amount equal to--
                    ``(A) such dollar amount, multiplied by
                    ``(B) the cost-of-living adjustment determined 
                under section 1(f)(3) for the calendar year in which 
                the taxable year begins, except that section 1(f)(3)(B) 
                shall be applied by substituting `1997' for `1992'.
            ``(7) Subsequent payments.--If any payment with respect to 
        which a deduction was allowed under paragraph (1) is 
        subsequently made, such payment shall be included in gross 
        income of the eligible taxpayer for the taxable year in which 
        paid. This paragraph shall not apply to any amount if an 
        individual has assigned the right to receive such amount to a 
        State (and the State does not pay such amount to such 
        individual).
            ``(8) Support instrument.--For purposes of this subsection, 
        a support instrument meets the requirements of this paragraph 
        if it is--
                    ``(A) a decree of divorce or separate maintenance 
                or a written instrument incident to such a decree,
                    ``(B) a written separation agreement, or
                    ``(C) a decree (not described in subparagraph (A)) 
                of a court or administrative agency requiring a parent 
                to make payments for the support or maintenance of 1 or 
                more children of such parent.''
    (b) Deduction for Nonitemizers.--Section 62(a) of such Code is 
amended by inserting after paragraph (16) the following new paragraph:
            ``(17) Unpaid child support payments.--The deduction 
        allowed by section 166(f).''
    (c) Conforming Amendment.--Section 166(d)(2) of such Code is 
amended by striking ``or'' at the end of subparagraph (A), by striking 
the period at the end of subparagraph (B) and inserting ``, or'' and by 
adding at the end thereof the following new subparagraph:
                    ``(C) a debt which is an applicable child support 
                payment under subsection (f).''
    (d) Effective Date.--The amendments made by this section shall 
apply to taxable years beginning after December 31, 1997.

SEC. 5. REDUCTION OF FEDERAL DEBT.

    Net revenues received in the Treasury pursuant to this Act shall be 
applied, as provided in appropriation Acts, solely to the retirement of 
outstanding public debt obligations of the United States and may not be 
obligated or expended for any other purpose, notwithstanding any other 
provision of law that does not specifically refer to this section.
[EX A]: Child Support Security Act - Amends the Internal Revenue Code relating to discharge of indebtedness income to provide that any taxable unpaid child support payments of a taxpayer for any taxable year shall be treated as amounts includible in the taxpayer's gross income by reason of the discharge of the taxpayer's indebtedness.  Sets forth notice guidelines. 
Allows an eligible taxpayer with respect to whom child support payments remain unpaid during the taxable year a deduction of up to $5,000 equal to the amount of payments remaining unpaid.  Limits such deductions to taxpayers with adjusted gross incomes under $50,000 and unpaid child support payments of $500 or more. 
Requires that net revenues received in the Treasury pursuant to this Act be applied solely to the retirement of outstanding Federal debt obligations and not be obligated or expended for any other purpose.

[EX Q]: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Ensuring Patient Access to 
Healthcare Records Act of 2016''.

SEC. 2. PROMOTION OF ACCESS TO DATA, VIA RESEARCH AND USER FRIENDLY 
              PRESENTATIONS AND APPLICATIONS.

    (a) In General.--Subtitle D of the Health Information Technology 
for Economic and Clinical Health Act (42 U.S.C. 17921 et seq.) is 
amended by adding at the end the following:

   ``PART 3--HEALTH CARE CLEARINGHOUSES; DATA PROCESSING TO EMPOWER 
              PATIENTS AND IMPROVE THE HEALTH CARE SYSTEM

``SEC. 13451. MODERNIZING THE ROLE OF CLEARINGHOUSES IN HEALTH CARE.

    ``(a) Efforts To Promote Access to and Leveraging of Health 
Information.--
            ``(1) In general.--The Secretary shall, through the 
        updating of existing policies and development of policies that 
        support dynamic technology solutions, promote patient access to 
        information related to their care, including real world 
        outcomes and economic data (including claims, eligibility, and 
        payment data), in a manner that would ensure that such 
        information is available in a form convenient for the patient, 
        in a reasonable manner, and without burdening the health care 
        provider involved.
            ``(2) Requirement.--Activities carried out under paragraph 
        (1) shall include the development of policies to enable covered 
        entities with access to health information to--
                    ``(A) provide patient access to information related 
                to their care, including real world outcomes and 
                economic data; and
                    ``(B) develop patient engagement tools, reports, 
                analyses, and presentations based on population health, 
                epidemiological, and health services outcomes data, 
                that may demonstrate a fiscal or treatment benefit to 
                the taxpayer.
    ``(b) Treatment as Covered Entity for Specified Functions.--
            ``(1) In general.--With respect to the use and disclosure 
        of protected health information, the Secretary shall--
                    ``(A) not consider health care clearinghouses that 
                engage in the functions described in paragraph (3) to 
                be business associates under HIPAA-related provisions 
                (as defined in subsection (j)(3)) regardless of the 
                role of such clearinghouses in collecting or receiving 
                the information; and
                    ``(B) consider such clearinghouses to be covered 
                entities under such provisions of law for all purposes.
        Such clearinghouses shall not be considered business associates 
        for data translation, analytic, cloud computing, or any other 
        purpose.
            ``(2) Data accuracy and security requirement.--In order to 
        use health data as authorized by this section, a clearinghouse 
        or other covered entity engaging in activities authorized under 
        this section shall be certified to have the necessary expertise 
        and technical infrastructure to ensure the accuracy and 
        security of such claims, eligibility, and payment data through 
        receipt of an accreditation by the Electronic Healthcare 
        Network Accreditation Commission, or by an equivalent 
        accreditation program determined appropriate by the Secretary.
            ``(3) Enhancing treatment, quality improvement, research, 
        public health efforts and other functions.--
                    ``(A) Equivalent authority to other covered 
                entities.--Subject to paragraph (2), a health care 
                clearinghouse shall--
                            ``(i) in addition to carrying out claims 
                        processing functions, be permitted to use and 
                        disclose protected health information in the 
                        same manner as other covered entities, 
                        including for purposes of treatment, payment, 
                        health care operations as permitted by section 
                        164.506 of title 45, Code of Federal 
                        Regulations, research, and public health as 
                        permitted by section 164.512 of title 45, Code 
                        of Federal Regulations, and creating de-
                        identified information as permitted by section 
                        164.502(d) of title 45, Code of Federal 
                        Regulations; and
                            ``(ii) use or disclose protected health 
                        information as required by section 
                        164.502(a)(2) of title 45, Code of Federal 
                        Regulations.
                    ``(B) Additional authority.--Subject to paragraph 
                (2), a health care clearinghouse and other covered 
                entity shall, in addition to claims processing 
                functions, be permitted to--
                            ``(i) provide individuals with access to 
                        their own protected health information as 
                        described in subsection (d);
                            ``(ii) subject to subsection (c)(2), and on 
                        behalf of both covered entities and non-covered 
                        entities, use and disclose protected health 
                        information for health care operations purposes 
                        (as defined by section 164.501 of title 45, 
                        Code of Federal Regulations) without respect to 
                        whether the recipient of the information has or 
                        had a relationship with the individual;
                            ``(iii) subject to subsection (c)(2), and 
                        upon the request of a covered entity, benchmark 
                        the operations of such covered entity against 
                        the operations of one or more other covered 
                        entities that have elected to participate in 
                        such benchmarking; and
                            ``(iv) subject to subsection (c)(2), use 
                        protected health information to facilitate 
                        clinical trial recruitment.
    ``(c) Authorities Relating to Data Processing.--
            ``(1) In general.--In carrying out HIPAA-related 
        provisions, the Secretary shall permit a health care 
        clearinghouse to aggregate protected health information that 
        the clearinghouse possesses in order to carry out the functions 
        described in subsection (b)(3). Subject to section 
        164.502(a)(5)(i) of title 45, Code of Federal Regulations, a 
        health care clearinghouse may carry out the functions described 
        in subsection (b)(3) without obtaining individual authorization 
        under section 164.508 of title 45, Code of Federal Regulations.
            ``(2) Privacy.--For purposes of clauses (ii) through (iv) 
        of subsection (b)(3)(B), with respect to any report, analysis, 
        or presentation provided by the clearinghouse to a third party, 
        such report, analysis, or presentation--
                    ``(A) shall include only de-identified data; or
                    ``(B) if containing protected health information, 
                shall include such data that is subject to a qualifying 
                data use agreement (as defined in subsection (j)).
            ``(3) Fee permitted.--Nothing in this paragraph shall be 
        construed to prohibit an individual's right to access claims 
        and payment records in HIPAA standard format for a reasonable, 
        cost-based fee pursuant to section 164.524(c)(4) of title 45, 
        Code of Federal Regulations. In requesting access to records 
        held by a health care clearinghouse, the individual shall 
        identify the health care provider or providers that rendered 
        care.
    ``(d) Comprehensive Records at the Request of an Individual.--
            ``(1) In general.--When a health care clearinghouse 
        receives a written request from an individual for the protected 
        health information of the individual, the clearinghouse shall 
        provide to the individual a comprehensive record of such 
        information (across health care providers and health plans and 
        longitudinal in scope), unless the clearinghouse determines in 
        its sole discretion that providing a comprehensive record is 
        not technologically feasible.
            ``(2) Purchase from other clearinghouses.--In preparing a 
        comprehensive record for an individual under paragraph (1), a 
        health care clearinghouse may, with the permission of the 
        individual, purchase the protected health information of the 
        individual from one or more other health clearinghouses (and 
        the cost of such purchase may be included in a fair-market fee 
        charged to the individual as provided for under paragraph (1)).
    ``(e) Situations Not Involving Direct Interaction With 
Individuals.--Sections 164.400 through 164.414 (relating to breach 
notification) and sections 164.520 through 164.528 (relating to 
individual rights) of title 45, Code of Federal Regulations, shall 
apply to a health care clearinghouse that engages in the functions 
described in subsection (b)(3) to the extent that such clearinghouse 
has current contact information pursuant to direct interaction with the 
individual involved. In the case of each other individual, the 
clearinghouse shall provide notice to the covered entity of any breach 
of unsecured protected health information and provide a notice of 
privacy practices on its website.
    ``(f) Transition.--
            ``(1) In general.--Nothing in this section shall be 
        construed to provide a health care clearinghouse greater 
        authority to use and disclose protected health information than 
        that provided to another covered entity.
            ``(2) Existing agreements.--With respect to agreements 
        entered into by a health care clearinghouse prior to the date 
        of enactment of this section, a provision of such an agreement 
        that conflicts with this section shall not have any legal force 
        or effect. The preceding sentence may not be construed as 
        affecting any provision of an agreement that does not conflict 
        with this section.
    ``(g) Safe Harbor and Clarification of Liability.--In the case of a 
health care clearinghouse that engages in a function described in 
subsection (b), only that clearinghouse may be held liable for a 
violation of a HIPAA-related provision (and a covered entity that 
provided data or data access to the clearinghouse shall not be liable 
for such violations).
    ``(h) Enforcement.--Section 13410(a)(2) shall apply to this section 
in the same manner as such section applies to parts 1 and 2.
    ``(i) Relation to Other Laws.--
            ``(1) Application of hitech rule.--Section 13421 shall 
        apply to this section in the same manner as such section 
        applies to parts 1 and 2, except to the extent that such 
        section 13421 concerns section 1178(a)(2)(B) of the Social 
        Security Act.
            ``(2) State laws regarding unfair or deceptive acts or 
        practices.--This part shall not be construed to preempt the law 
        of any State that prohibits unfair or deceptive acts or 
        practices.
    ``(j) Definitions.--In this part:
            ``(1) De-identified.--The term `de-identified', with 
        respect to health information, means such information that is 
        not individually identifiable as determined in accordance with 
        the standards under section 164.514(b) of title 45, Code of 
        Federal Regulations.
            ``(2) Health care clearinghouse.--The term `health care 
        clearinghouse' has the meaning given such term in section 1171 
        of the Social Security Act.
            ``(3) HIPAA-related provision.--The term `HIPAA-related 
        provision' means the provisions of each of the following:
                    ``(A) This subtitle.
                    ``(B) Part C of title XI of the Social Security 
                Act.
                    ``(C) Regulations promulgated pursuant to sections 
                262(a) and 264(c) of the Health Insurance Portability 
                and Accountability Act of 1996 or this subtitle.
            ``(4) Individual.--The term `individual', with respect to 
        protected health information, has the meaning applicable under 
        section 160.103 of title 45, Code of Federal Regulations.
            ``(5) Qualifying data use agreement.--The term `qualifying 
        data use agreement' means an agreement, which may be 
        electronic, that establishes the permitted uses and disclosures 
        of protected health information by the recipient consistent 
        with this paragraph. A qualifying data use agreement between 
        the health care clearinghouse and the data recipient shall--
                    ``(A) establish the permitted uses and disclosures 
                of such information by the recipient which shall be 
                limited to the original purpose of disclosure under 
                subsection (b)(3)(B); and
                    ``(B) provide that the data recipient will--
                            ``(i) not use or further disclose the 
                        information other than as permitted by the 
                        qualifying data use agreement or as otherwise 
                        required by law;
                            ``(ii) use appropriate safeguards to 
                        prevent use or disclosure of the information 
                        other than as provided for by the qualifying 
                        data use agreement; and
                            ``(iii) ensure that any agents to whom it 
                        provides the data agree to the same 
                        restrictions and conditions that apply to the 
                        data recipient with respect to such 
                        information.''.
    (b) Regulations.--Not later than 30 days after the date of the 
enactment of this Act, the Secretary of Health and Human Services shall 
promulgate regulations to carry out the amendment made by subsection 
(a).
    (c) Conforming Amendment.--Section 1171(2) of the Social Security 
Act (42 U.S.C. 1320d(2)) is amended by inserting before the period the 
following: ``or receives a standard transaction from another entity and 
processes or facilitates the processing of health information into 
nonstandard format or nonstandard data content for the receiving 
entity. Such term also includes an entity that carries out such 
processing functions, processes standard health care claims, processes 
health care claim payments or provides advice on such, and processes 
eligibility claims relating to health plan transactions on behalf of a 
HIPAA covered entity and in addition, engages in any of the functions 
described in subsection (a) of section 13451 of the Health Information 
Technology for Economic and Clinical Health Act''.
[EX A]:
Ensuring Patient Access to Healthcare Records Act of 2016 This bill amends the Health Information Technology for Economic and Clinical Health Act to require the Department of Health and Human Services to develop and update policies that enable certain health care clearinghouses, plans, and providers&nbsp;to: (1) provide patients with access to information related to their care; and (2) develop patient-engagement tools, reports, analyses, and presentations that may demonstrate benefit to the taxpayer.