Browse Arkansas Code titles and sections
42 U.S.C. § 17939 — Business associate contracts required for certain entities
Federal law — U.S. Code and appendices · legal_authorities
Each organization, with respect to a covered entity, that provides data transmission of protected health information to such entity (or its business associate) and that requires access on a routine basis to such protected health information, such as a Health Information Exchange Organization, Regional Health Information Organization, E-prescribing Gateway, or each vendor that contracts with a covered entity to allow that covered entity to offer a personal health record to patients as part of its electronic health record, is required to enter into a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations and a written contract (or other arrangement) described in section 164.308(b) of such title, with such entity and shall be treated as a business associate of the covered entity for purposes of the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009.
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17939
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: 854a49160bdf3636add58dab9d663364f167d4c5c8583ccd33056faa61b5f81a. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_e89b982734012def231f36e0
Source file: Laws/federal/codes/united-states-code/title-42/section-17939-business-associate-contracts-required-for-certain-entities--a210c18d3b.md
Pages: Not recorded – Not recorded
Passage SHA-256: 312d7dd9ecab6eed9d9319db82be9e1cee245357ed53d8703c71693866edb23b
Source location: Title 42, Chapter 156, § 17939; chapter-156-health-information-technology.md
Stored source content
Each organization, with respect to a covered entity, that provides data transmission of protected health information to such entity (or its business associate) and that requires access on a routine basis to such protected health information, such as a Health Information Exchange Organization, Regional Health Information Organization, E-prescribing Gateway, or each vendor that contracts with a covered entity to allow that covered entity to offer a personal health record to patients as part of its electronic health record, is required to enter into a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations and a written contract (or other arrangement) described in section 164.308(b) of such title, with such entity and shall be treated as a business associate of the covered entity for purposes of the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
In this subchapter, except as specified otherwise:
(1) **Breach**
(A) *In general* — The term “breach” means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.
(B) *Exceptions* — The term “breach” does not include—
(i) any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if—
(I) such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate; and
(II) such information is not further acquired, accessed, used, or disclosed by any person; or
(ii) any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at 11 So in original. Probably should be followed by “the”. same facility; and
(iii) any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person.
(2) **Business associate** — The term “business associate” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(3) **Covered entity** — The term “covered entity” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(4) **Disclose** — The terms “
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17931
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
Page 9077
TITLE 42—THE PUBLIC HEALTH AND WELFARE
§ 17940
1 So in original. Probably should be ‘‘this’’.
2 So in original. Probably should be ‘‘sections’’.
164.308(b) of such title, with such entity and
shall be treated as a business associate of the
covered entity for purposes of the provisions of
this subchapter and subparts C and E of part 164
of title 45, Code of Federal Regulations, as such
provisions are in effect as of February 17, 2009.
(Pub. L. 111–5, div. A, title XIII, § 13408, Feb. 17,
2009, 123 Stat. 271.)
Editorial Notes
REFERENCES IN TEXT
This subchapter, referred to in text, was in the origi-
nal ‘‘this subtitle’’, meaning subtitle D (§ 13400 et seq.)
of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123
Stat. 258, which is classified principally to this sub-
chapter. For complete classification of subtitle D to
the Code, see Tables.
Statutory Notes and Related Subsidiaries
EFFECTIVE DATE
Section effective 12 months after Feb. 17, 2009, except
as otherwise specifically provided, see section 13423 of
Pub. L. 111–5, set out as a note under section 17931 of
this title.
§ 17939. Improved enforcement
(a) In general
(1) Omitted
(2) Enforcement under Social Security Act
Any violation by a covered entity under
thus 1 subchapter is subject to enforcement
and penalties under section 2 1176 and 1177 of
the Social Security Act [42 U.S.C. 1320d–5,
1320d–6].
(b) Effective date; regulations
(1) The amendments made by subsection (a)
shall apply to penalties imposed on or after the
date that is 24 months after February 17, 2009.
(2) Not later than 18 months after February 17,
2009, the Secretary of Health and Human Serv-
ices shall promulgate regulations to implement
such amendments.
(c) Distribution of certain civil monetary pen
Source: Supplied 2024 U.S. Code historical extraction · 42 U.S.C. § 17939
Stored review status: historical_2024_not_currentness_verified. Same stored citation; legal effect and authority still require review.