Browse Arkansas Code titles and sections
42 U.S.C. § 17931 — Definitions
Federal law — U.S. Code and appendices · legal_authorities
In this subchapter, except as specified otherwise:
(1) **Breach**
(A) *In general* — The term “breach” means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.
(B) *Exceptions* — The term “breach” does not include—
(i) any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if—
(I) such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate; and
(II) such information is not further acquired, accessed, used, or disclosed by any person; or
(ii) any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at 11 So in original. Probably should be followed by “the”. same facility; and
(iii) any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person.
(2) **Business associate** — The term “business associate” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(3) **Covered entity** — The term “covered entity” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(4) **Disclose** — The terms “
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17931
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: 4ef53c04376fb4b64e26bac9c1b34811d50654f766d3976560c53dcb52401ade. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_15605e651beec840a92d07e6
Source file: Laws/federal/codes/united-states-code/title-42/section-17931-definitions--cba00d09f6.md
Pages: Not recorded – Not recorded
Passage SHA-256: 62a6e1b70abb91625c973907c3c8c72cdc4ef8ea8ba1a6011a96c62b58c55cb8
Source location: Title 42, Chapter 156, § 17931; chapter-156-health-information-technology.md
Stored source content
In this subchapter, except as specified otherwise:
(1) **Breach**
(A) *In general* — The term “breach” means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.
(B) *Exceptions* — The term “breach” does not include—
(i) any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if—
(I) such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate; and
(II) such information is not further acquired, accessed, used, or disclosed by any person; or
(ii) any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at 11 So in original. Probably should be followed by “the”. same facility; and
(iii) any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person.
(2) **Business associate** — The term “business associate” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(3) **Covered entity** — The term “covered entity” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(4) **Disclose** — The terms “disclose” and “disclosure” have the meaning given the term “disclosure” in section 160.103 of title 45, Code of Federal Regulations.
(5) **Electronic health record** — The term “electronic health record” means an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff.
(6) **Health care operations** — The term “health care operation” has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations.
(7) **Health care provider** — The term “health care provider” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(8) **Health plan** — The term “health plan” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(9) **National Coordinator** — The term “National Coordinator” means the head of the Office of the National Coordinator for Health Information Technology established under [section 300jj–11(a) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section300jj–11/a&num=0&edition=prelim), as added by section 13101.22 See References in Text note below.
(10) **Payment** — The term “payment” has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations.
(11) **Personal health record** — The term “personal health record” means an electronic record of PHR identifiable health information (as defined in [section 17937(f)(2) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17937/f/2&num=0&edition=prelim)) on an individual that can be drawn from multiple sources and that is managed, shared, and controlled by or primarily for the individual.
(12) **Protected health information** — The term “protected health information” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(13) **Secretary** — The term “Secretary” means the Secretary of Health and Human Services.
(14) **Security** — The term “security” has the meaning given such term in section 164.304 of title 45, Code of Federal Regulations.
(15) **State** — The term “State” means each of the several States, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands.
(16) **Treatment** — The term “treatment” has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations.
(17) **Use** — The term “use” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(18) **Vendor of personal health records** — The term “vendor of personal health records” means an entity, other than a covered entity (as defined in paragraph (3)), that offers or maintains a personal health record.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
**(a) General penalty**
(1) **In general** — Except as provided in subsection (b), the Secretary shall impose on any person who violates a provision of this part—
(A) in the case of a violation of such provision in which it is established that the person did not know (and by exercising reasonable diligence would not have known) that such person violated such provision, a penalty for each such violation of an amount that is at least the amount described in paragraph (3)(A) but not to exceed the amount described in paragraph (3)(D);
(B) in the case of a violation of such provision in which it is established that the violation was due to reasonable cause and not to willful neglect, a penalty for each such violation of an amount that is at least the amount described in paragraph (3)(B) but not to exceed the amount described in paragraph (3)(D); and
(C) in the case of a violation of such provision in which it is established that the violation was due to willful neglect—
(i) if the violation is corrected as described in subsection (b)(3)(A),11 So in original. Probably should be “(b)(2)(A),”. a penalty in an amount that is at least the amount described in paragraph (3)(C) but not to exceed the amount described in paragraph (3)(D); and
(ii) if the violation is not corrected as described in such subsection, a penalty in an amount that is at least the amount described in paragraph (3)(D).
In determining the amount of a penalty under this section for a violation, the Secretary shall base such determination on the nature and extent of the violation and the nature and extent of the harm resulting from such violation.
(2) **Procedures** — The provisions of [section 1320a–7a of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-se
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 1320d–5
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Offense** A person who knowingly and in violation of this part—
(1) uses or causes to be used a unique health identifier;
(2) obtains individually identifiable health information relating to an individual; or
(3) discloses individually identifiable health information to another person,
shall be punished as provided in subsection (b). For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in [section 1320d–9(b)(3) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d–9/b/3&num=0&edition=prelim)) and the individual obtained or disclosed such information without authorization.
**(b) Penalties** A person described in subsection (a) shall—
(1) be fined not more than $50,000, imprisoned not more than 1 year, or both;
(2) if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both; and
(3) if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both.
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 1320d–6
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general** A covered entity that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured protected health information (as defined in subsection (h)(1)) shall, in the case of a breach of such information that is discovered by the covered entity, notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, or disclosed as a result of such breach.
**(b) Notification of covered entity by business associate** A business associate of a covered entity that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured protected health information shall, following the discovery of a breach of such information, notify the covered entity of such breach. Such notice shall include the identification of each individual whose unsecured protected health information has been, or is reasonably believed by the business associate to have been, accessed, acquired, or disclosed during such breach.
**(c) Breaches treated as discovered** For purposes of this section, a breach shall be treated as discovered by a covered entity or by a business associate as of the first day on which such breach is known to such entity or associate, respectively, (including any person, other than the individual committing the breach, that is an employee, officer, or other agent of such entity or associate, respectively) or should reasonably have been known to such entity or associate (or person) to have occurred.
**(d) Timeliness of notification**
(1) **In general** — Subject to subsection (g), all notifications required under this section shall be made without unreasonable delay and in no ca
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17933
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Regional office privacy advisors** Not later than 6 months after February 17, 2009, the Secretary shall designate an individual in each regional office of the Department of Health and Human Services to offer guidance and education to covered entities, business associates, and individuals on their rights and responsibilities related to Federal privacy and security requirements for protected health information.
**(b) Education initiative on uses of health information** Not later than 12 months after February 17, 2009, the Office for Civil Rights within the Department of Health and Human Services shall develop and maintain a multi-faceted national education initiative to enhance public transparency regarding the uses of protected health information, including programs to educate individuals about the potential uses of their protected health information, the effects of such uses, and the rights of individuals with respect to such uses. Such programs shall be conducted in a variety of languages and present information in a clear and understandable manner.
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17934
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Application of contract requirements** In the case of a business associate of a covered entity that obtains or creates protected health information pursuant to a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations, with such covered entity, the business associate may use and disclose such protected health information only if such use or disclosure, respectively, is in compliance with each applicable requirement of section 164.504(e) of such title. The additional requirements of this subchapter that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity.
**(b) Application of knowledge elements associated with contracts** Section 164.504(e)(1)(ii) of title 45, Code of Federal Regulations, shall apply to a business associate described in subsection (a), with respect to compliance with such subsection, in the same manner that such section applies to a covered entity, with respect to compliance with the standards in sections 164.502(e) and 164.504(e) of such title, except that in applying such section 164.504(e)(1)(ii) each reference to the business associate, with respect to a contract, shall be treated as a reference to the covered entity involved in such contract.
**(c) Application of civil and criminal penalties** In the case of a business associate that violates any provision of subsection (a) or (b), the provisions of sections 1176 and 1177 of the Social Security Act ([42 U.S.C. 1320d–5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-5&num=0&edition=prelim), 1320
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17935
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Requested restrictions on certain disclosures of health information** In the case that an individual requests under paragraph (a)(1)(i)(A) of section 164.522 of title 45, Code of Federal Regulations, that a covered entity restrict the disclosure of the protected health information of the individual, notwithstanding paragraph (a)(1)(ii) of such section, the covered entity must comply with the requested restriction if—
(1) except as otherwise required by law, the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for purposes of carrying out treatment); and
(2) the protected health information pertains solely to a health care item or service for which the health care provider involved has been paid out of pocket in full.
**(b) Disclosures required to be limited to the limited data set or the minimum necessary**
(1) **In general**
(A) *In general* — Subject to subparagraph (B), a covered entity shall be treated as being in compliance with section 164.502(b)(1) of title 45, Code of Federal Regulations, with respect to the use, disclosure, or request of protected health information described in such section, only if the covered entity limits such protected health information, to the extent practicable, to the limited data set (as defined in section 164.514(e)(2) of such title) or, if needed by such entity, to the minimum necessary to accomplish the intended purpose of such use, disclosure, or request, respectively.
(B) *Guidance* — Not later than 18 months after February 17, 2009, the Secretary shall issue guidance on what constitutes “minimum necessary” for purposes of subpart E of part 164 of title 45, Code of Federal Regulation.11 So in original. Probably should be “Regulations.” In issuing such guidan
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17936
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Marketing**
(1) **In general** — A communication by a covered entity or business associate that is about a product or service and that encourages recipients of the communication to purchase or use the product or service shall not be considered a health care operation for purposes of subpart E of part 164 of title 45, Code of Federal Regulations, unless the communication is made as described in subparagraph (i), (ii), or (iii) of paragraph (1) of the definition of marketing in section 164.501 of such title.
(2) **Payment for certain communications** — A communication by a covered entity or business associate that is described in subparagraph (i), (ii), or (iii) of paragraph (1) of the definition of marketing in section 164.501 of title 45, Code of Federal Regulations, shall not be considered a health care operation for purposes of subpart E of part 164 of title 45, Code of Federal Regulations if the covered entity receives or has received direct or indirect payment in exchange for making such communication, except where—
(A)
(i) such communication describes only a drug or biologic that is currently being prescribed for the recipient of the communication; and
(ii) any payment received by such covered entity in exchange for making a communication described in clause (i) is reasonable in amount;
(B) each of the following conditions apply—
(i) the communication is made by the covered entity; and
(ii) the covered entity making such communication obtains from the recipient of the communication, in accordance with section 164.508 of title 45, Code of Federal Regulations, a valid authorization (as described in paragraph (b) of such section) with respect to such communication; or
(C) each of the following conditions apply—
(i) the communi
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17937
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general** In accordance with subsection (c), each vendor of personal health records, following the discovery of a breach of security of unsecured PHR identifiable health information that is in a personal health record maintained or offered by such vendor, and each entity described in clause (ii), (iii), or (iv) of [section 17953(b)(1)(A) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17953/b/1/A&num=0&edition=prelim), following the discovery of a breach of security of such information that is obtained through a product or service provided by such entity, shall—
(1) notify each individual who is a citizen or resident of the United States whose unsecured PHR identifiable health information was acquired by an unauthorized person as a result of such a breach of security; and
(2) notify the Federal Trade Commission.
**(b) Notification by third party service providers** A third party service provider that provides services to a vendor of personal health records or to an entity described in clause (ii), (iii).11 So in original. The period probably should be a comma. or (iv) of [section 17953(b)(1)(A) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17953/b/1/A&num=0&edition=prelim) in connection with the offering or maintenance of a personal health record or a related product or service and that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured PHR identifiable health information in such a record as a result of such services shall, following the discovery of a breach of security of such information, notify such vendor or entity, respectively, of such breach. Such notice shall include the identification of each indiv
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17938
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
Each organization, with respect to a covered entity, that provides data transmission of protected health information to such entity (or its business associate) and that requires access on a routine basis to such protected health information, such as a Health Information Exchange Organization, Regional Health Information Organization, E-prescribing Gateway, or each vendor that contracts with a covered entity to allow that covered entity to offer a personal health record to patients as part of its electronic health record, is required to enter into a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations and a written contract (or other arrangement) described in section 164.308(b) of such title, with such entity and shall be treated as a business associate of the covered entity for purposes of the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009.
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17939
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general**
(1) **Omitted**
(2) **Enforcement under Social Security Act** — Any violation by a covered entity under thus 11 So in original. Probably should be “this”. subchapter is subject to enforcement and penalties under section 22 So in original. Probably should be “sections”. 1176 and 1177 of the Social Security Act [[42 U.S.C. 1320d–5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-5&num=0&edition=prelim), 1320d–6].
**(b) Effective date; regulations**
(1) The amendments made by subsection (a) shall apply to penalties imposed on or after the date that is 24 months after February 17, 2009.
(2) Not later than 18 months after February 17, 2009, the Secretary of Health and Human Services shall promulgate regulations to implement such amendments.
**(c) Distribution of certain civil monetary penalties collected**
(1) **In general** — Subject to the regulation promulgated pursuant to paragraph (3), any civil monetary penalty or monetary settlement collected with respect to an offense punishable under this subchapter or section 1176 of the Social Security Act ([42 U.S.C. 1320d–5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-5&num=0&edition=prelim)) insofar as such section relates to privacy or security shall be transferred to the Office for Civil Rights of the Department of Health and Human Services to be used for purposes of enforcing the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009.
(2) **GAO report** — Not later than 18 months after February 17, 2009, the Comptroller General shall submit to the Secretary a report including recommendations for a methodology under which a
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17940
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.