Browse Arkansas Code titles and sections
42 U.S.C. § 17938 — Temporary breach notification requirement for vendors of personal health records and other non-HIPAA covered entities
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general** In accordance with subsection (c), each vendor of personal health records, following the discovery of a breach of security of unsecured PHR identifiable health information that is in a personal health record maintained or offered by such vendor, and each entity described in clause (ii), (iii), or (iv) of [section 17953(b)(1)(A) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17953/b/1/A&num=0&edition=prelim), following the discovery of a breach of security of such information that is obtained through a product or service provided by such entity, shall—
(1) notify each individual who is a citizen or resident of the United States whose unsecured PHR identifiable health information was acquired by an unauthorized person as a result of such a breach of security; and
(2) notify the Federal Trade Commission.
**(b) Notification by third party service providers** A third party service provider that provides services to a vendor of personal health records or to an entity described in clause (ii), (iii).11 So in original. The period probably should be a comma. or (iv) of [section 17953(b)(1)(A) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17953/b/1/A&num=0&edition=prelim) in connection with the offering or maintenance of a personal health record or a related product or service and that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured PHR identifiable health information in such a record as a result of such services shall, following the discovery of a breach of security of such information, notify such vendor or entity, respectively, of such breach. Such notice shall include the identification of each indiv
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17938
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: 3c6dc930b3b7944eea1710288b0a903a5a4d0b6e30eddbfbdfc2c9febfacc2ac. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_f8bf31069a1a2a84f5717487
Source file: Laws/federal/codes/united-states-code/title-42/section-17938-temporary-breach-notification-requirement-for-vendors-of-personal-health--47ee84e8f4.md
Pages: Not recorded – Not recorded
Passage SHA-256: 664833ae32195c9612796879fb75422fc9cfc841363462f621c72a504f06fa42
Source location: Title 42, Chapter 156, § 17938; chapter-156-health-information-technology.md
Stored source content
**(a) In general** In accordance with subsection (c), each vendor of personal health records, following the discovery of a breach of security of unsecured PHR identifiable health information that is in a personal health record maintained or offered by such vendor, and each entity described in clause (ii), (iii), or (iv) of [section 17953(b)(1)(A) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17953/b/1/A&num=0&edition=prelim), following the discovery of a breach of security of such information that is obtained through a product or service provided by such entity, shall—
(1) notify each individual who is a citizen or resident of the United States whose unsecured PHR identifiable health information was acquired by an unauthorized person as a result of such a breach of security; and
(2) notify the Federal Trade Commission.
**(b) Notification by third party service providers** A third party service provider that provides services to a vendor of personal health records or to an entity described in clause (ii), (iii).11 So in original. The period probably should be a comma. or (iv) of [section 17953(b)(1)(A) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17953/b/1/A&num=0&edition=prelim) in connection with the offering or maintenance of a personal health record or a related product or service and that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured PHR identifiable health information in such a record as a result of such services shall, following the discovery of a breach of security of such information, notify such vendor or entity, respectively, of such breach. Such notice shall include the identification of each individual whose unsecured PHR identifiable health information has been, or is reasonably believed to have been, accessed, acquired, or disclosed during such breach.
**(c) Application of requirements for timeliness, method, and content of notifications** Subsections (c), (d), (e), and (f) of [section 17932 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17932&num=0&edition=prelim) shall apply to a notification required under subsection (a) and a vendor of personal health records, an entity described in subsection (a) and a third party service provider described in subsection (b), with respect to a breach of security under subsection (a) of unsecured PHR identifiable health information in such records maintained or offered by such vendor, in a manner specified by the Federal Trade Commission.
**(d) Notification of the Secretary** Upon receipt of a notification of a breach of security under subsection (a)(2), the Federal Trade Commission shall notify the Secretary of such breach.
**(e) Enforcement** A violation of subsection (a) or (b) shall be treated as an unfair and deceptive act or practice in violation of a regulation under [section 57a(a)(1)(B) of title 15](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section57a/a/1/B&num=0&edition=prelim) regarding unfair or deceptive acts or practices.
**(f) Definitions** For purposes of this section:
(1) **Breach of security** — The term “breach of security” means, with respect to unsecured PHR identifiable health information of an individual in a personal health record, acquisition of such information without the authorization of the individual.
(2) **PHR identifiable health information** — The term “PHR identifiable health information” means individually identifiable health information, as defined in [section 1320d(6) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d/6&num=0&edition=prelim), and includes, with respect to an individual, information—
(A) that is provided by or on behalf of the individual; and
(B) that identifies the individual or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.
(3) **Unsecured PHR identifiable health information**
(A) *In general* — Subject to subparagraph (B), the term “unsecured PHR identifiable health information” means PHR identifiable health information that is not protected through the use of a technology or methodology specified by the Secretary in the guidance issued under [section 17932(h)(2) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17932/h/2&num=0&edition=prelim).
(B) *Exception in case timely guidance not issued* — In the case that the Secretary does not issue guidance under [section 17932(h)(2) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section17932/h/2&num=0&edition=prelim) by the date specified in such section, for purposes of this section, the term “unsecured PHR identifiable health information” shall mean PHR identifiable health information that is not secured by a technology standard that renders protected health information unusable, unreadable, or indecipherable to unauthorized individuals and that is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute.
**(g) Regulations; effective date; sunset**
(1) **Regulations; effective date** — To carry out this section, the Federal Trade Commission shall promulgate interim final regulations by not later than the date that is 180 days after February 17, 2009. The provisions of this section shall apply to breaches of security that are discovered on or after the date that is 30 days after the date of publication of such interim final regulations.
(2) **Sunset** — If Congress enacts new legislation establishing requirements for notification in the case of a breach of security, that apply to entities that are not covered entities or business associates, the provisions of this section shall not apply to breaches of security discovered on or after the effective date of regulations implementing such legislation.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
In this subchapter, except as specified otherwise:
(1) **Breach**
(A) *In general* — The term “breach” means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.
(B) *Exceptions* — The term “breach” does not include—
(i) any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if—
(I) such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate; and
(II) such information is not further acquired, accessed, used, or disclosed by any person; or
(ii) any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at 11 So in original. Probably should be followed by “the”. same facility; and
(iii) any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person.
(2) **Business associate** — The term “business associate” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(3) **Covered entity** — The term “covered entity” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.
(4) **Disclose** — The terms “
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17931
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Application of security provisions** Sections 164.308, 164.310, 164.312, and 164.316 of title 45, Code of Federal Regulations, shall apply to a business associate of a covered entity in the same manner that such sections apply to the covered entity. The additional requirements of this title 11 See References in Text note below. that relate to security and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity.
**(b) Application of civil and criminal penalties** In the case of a business associate that violates any security provision specified in subsection (a), sections 1320d–5 and 1320d–6 of this title shall apply to the business associate with respect to such violation in the same manner such sections apply to a covered entity that violates such security provision.
**(c) Annual guidance** For the first year beginning after February 17, 2009, and annually thereafter, the Secretary of Health and Human Services shall, after consultation with stakeholders, annually issue guidance on the most effective and appropriate technical safeguards for use in carrying out the sections referred to in subsection (a) and the security standards in subpart C of part 164 of title 45, Code of Federal Regulations, including the use of standards developed under section 300jj–12(b)(2)(B)(vi) 1 of this title, as added by section 13101 of this Act, as such provisions are in effect as of the date before February 17, 2009.
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 17932
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
Page 9076
TITLE 42—THE PUBLIC HEALTH AND WELFARE
§ 17938
(iv) of section 17953(b)(1)(A) of this title in con-
nection with the offering or maintenance of a
personal health record or a related product or
service and that accesses, maintains, retains,
modifies, records, stores, destroys, or otherwise
holds, uses, or discloses unsecured PHR identifi-
able health information in such a record as a re-
sult of such services shall, following the dis-
covery of a breach of security of such informa-
tion, notify such vendor or entity, respectively,
of such breach. Such notice shall include the
identification of each individual whose unse-
cured PHR identifiable health information has
been, or is reasonably believed to have been,
accessed, acquired, or disclosed during such
breach.
(c) Application of requirements for timeliness,
method, and content of notifications
Subsections (c), (d), (e), and (f) of section 17932
of this title shall apply to a notification re-
quired under subsection (a) and a vendor of per-
sonal health records, an entity described in sub-
section (a) and a third party service provider de-
scribed in subsection (b), with respect to a
breach of security under subsection (a) of unse-
cured PHR identifiable health information in
such records maintained or offered by such ven-
dor, in a manner specified by the Federal Trade
Commission.
(d) Notification of the Secretary
Upon receipt of a notification of a breach of
security under subsection (a)(2), the Federal
Trade Commission shall notify the Secretary of
such breach.
(e) Enforcement
A violation of subsection (a) or (b) shall be
treated as an unfair and deceptive act or prac-
tice in violation of a regulation under section
57a(a)(1)(B) of title 15 regarding unfair or decep-
tive acts or p
Source: Supplied 2024 U.S. Code historical extraction · 42 U.S.C. § 17938
Stored review status: historical_2024_not_currentness_verified. Same stored citation; legal effect and authority still require review.