Browse Arkansas Code titles and sections
42 U.S.C. § 17932 — Application of security provisions and penalties to business associates of covered entities; annual guidance on security provisions
Federal law — U.S. Code and appendices · legal_authorities
**(a) Application of security provisions** Sections 164.308, 164.310, 164.312, and 164.316 of title 45, Code of Federal Regulations, shall apply to a business associate of a covered entity in the same manner that such sections apply to the covered entity. The additional requirements of this title 11 See References in Text note below. that relate to security and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity.
**(b) Application of civil and criminal penalties** In the case of a business associate that violates any security provision specified in subsection (a), sections 1320d–5 and 1320d–6 of this title shall apply to the business associate with respect to such violation in the same manner such sections apply to a covered entity that violates such security provision.
**(c) Annual guidance** For the first year beginning after February 17, 2009, and annually thereafter, the Secretary of Health and Human Services shall, after consultation with stakeholders, annually issue guidance on the most effective and appropriate technical safeguards for use in carrying out the sections referred to in subsection (a) and the security standards in subpart C of part 164 of title 45, Code of Federal Regulations, including the use of standards developed under section 300jj–12(b)(2)(B)(vi) 1 of this title, as added by section 13101 of this Act, as such provisions are in effect as of the date before February 17, 2009.
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17932
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: ede8c78c94a9e1c401fb3a7c90ae57747ee6e0a184894ecdcf2be5baef67a4e6. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_f89b617695290a1f9a4d404d
Source file: Laws/federal/codes/united-states-code/title-42/section-17932-application-of-security-provisions-and-penalties-to-business-associates--b9a75f4d73.md
Pages: Not recorded – Not recorded
Passage SHA-256: 20055975c5d255fbf146dc0b61e1aa2d2d5ed633541ee5cae885ecddf3f537aa
Source location: Title 42, Chapter 156, § 17932; chapter-156-health-information-technology.md
Stored source content
**(a) Application of security provisions** Sections 164.308, 164.310, 164.312, and 164.316 of title 45, Code of Federal Regulations, shall apply to a business associate of a covered entity in the same manner that such sections apply to the covered entity. The additional requirements of this title 11 See References in Text note below. that relate to security and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity.
**(b) Application of civil and criminal penalties** In the case of a business associate that violates any security provision specified in subsection (a), sections 1320d–5 and 1320d–6 of this title shall apply to the business associate with respect to such violation in the same manner such sections apply to a covered entity that violates such security provision.
**(c) Annual guidance** For the first year beginning after February 17, 2009, and annually thereafter, the Secretary of Health and Human Services shall, after consultation with stakeholders, annually issue guidance on the most effective and appropriate technical safeguards for use in carrying out the sections referred to in subsection (a) and the security standards in subpart C of part 164 of title 45, Code of Federal Regulations, including the use of standards developed under section 300jj–12(b)(2)(B)(vi) 1 of this title, as added by section 13101 of this Act, as such provisions are in effect as of the date before February 17, 2009.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
Beginning with fiscal year 2010, the Secretary shall transfer from the Public Health and Social Services Emergency Fund such sums as may be necessary to carry out this part.
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 201
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general** In accordance with subsection (c), each vendor of personal health records, following the discovery of a breach of security of unsecured PHR identifiable health information that is in a personal health record maintained or offered by such vendor, and each entity described in clause (ii), (iii), or (iv) of [section 17953(b)(1)(A) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17953/b/1/A&num=0&edition=prelim), following the discovery of a breach of security of such information that is obtained through a product or service provided by such entity, shall—
(1) notify each individual who is a citizen or resident of the United States whose unsecured PHR identifiable health information was acquired by an unauthorized person as a result of such a breach of security; and
(2) notify the Federal Trade Commission.
**(b) Notification by third party service providers** A third party service provider that provides services to a vendor of personal health records or to an entity described in clause (ii), (iii).11 So in original. The period probably should be a comma. or (iv) of [section 17953(b)(1)(A) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17953/b/1/A&num=0&edition=prelim) in connection with the offering or maintenance of a personal health record or a related product or service and that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured PHR identifiable health information in such a record as a result of such services shall, following the discovery of a breach of security of such information, notify such vendor or entity, respectively, of such breach. Such notice shall include the identification of each indiv
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17938
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Requirement** Records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance use disorder education, prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States shall, except as provided in subsection (e), be confidential and be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b).
**(b) Permitted disclosure**
(1) **Consent** — The following shall apply with respect to the contents of any record referred to in subsection (a):
(A) Such contents may be used or disclosed in accordance with the prior written consent of the patient with respect to whom such record is maintained.
(B) Once prior written consent of the patient has been obtained, such contents may be used or disclosed by a covered entity, business associate, or a program subject to this section for purposes of treatment, payment, and health care operations as permitted by the HIPAA regulations. Any information so disclosed may then be redisclosed in accordance with the HIPAA regulations. [Section 17935(c) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17935/c&num=0&edition=prelim) shall apply to all disclosures pursuant to subsection (b)(1) of this section.
(C) It shall be permissible for a patient’s prior written consent to be given once for all such future uses or disclosures for purposes of treatment, payment, and health care operations, until such time as the patient revokes such consent in writing.
(D) [Section 17935(a) of this title](https://uscode.house.gov/view.xh
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 290dd–2
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
Page 9069
TITLE 42—THE PUBLIC HEALTH AND WELFARE
§ 17932
1 See References in Text note below.
information (as defined in section 17937(f)(2) of
this title) on an individual that can be drawn
from multiple sources and that is managed,
shared, and controlled by or primarily for the
individual.
(12) Protected health information
The term ‘‘protected health information’’
has the meaning given such term in section
160.103 of title 45, Code of Federal Regulations.
(13) Secretary
The term ‘‘Secretary’’ means the Secretary
of Health and Human Services.
(14) Security
The term ‘‘security’’ has the meaning given
such term in section 164.304 of title 45, Code of
Federal Regulations.
(15) State
The term ‘‘State’’ means each of the several
States, the District of Columbia, Puerto Rico,
the Virgin Islands, Guam, American Samoa,
and the Northern Mariana Islands.
(16) Treatment
The term ‘‘treatment’’ has the meaning
given such term in section 164.501 of title 45,
Code of Federal Regulations.
(17) Use
The term ‘‘use’’ has the meaning given such
term in section 160.103 of title 45, Code of Fed-
eral Regulations.
(18) Vendor of personal health records
The
term
‘‘vendor
of
personal
health
records’’ means an entity, other than a cov-
ered entity (as defined in paragraph (3)), that
offers or maintains a personal health record.
(Pub. L. 111–5, div. A, title XIII, § 13400, Feb. 17,
2009, 123 Stat. 258.)
Editorial Notes
REFERENCES IN TEXT
This subchapter, referred to in text, was in the origi-
nal ‘‘this subtitle’’, meaning subtitle D (§ 13400 et seq.)
of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123
Stat. 258, which is classified principally to this sub-
chapter. For complete classification of subtitle D to
the Code, see Tables.
Section 13
Source: Supplied 2024 U.S. Code historical extraction · 42 U.S.C. § 17932
Stored review status: historical_2024_not_currentness_verified. Same stored citation; legal effect and authority still require review.