42 U.S.C. § 17938 — Business associate contracts required for

Page 9076 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17938 (iv) of section 17953(b)(1)(A) of this title in con- nection with the offering or maintenance of a personal health record or a related product or service and that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured PHR identifi- able health information in such a record as a re- sult of such services shall, following the dis- covery of a breach of security of such informa- tion, notify such vendor or entity, respectively, of such breach. Such notice shall include the identification of each individual whose unse- cured PHR identifiable health information has been, or is reasonably believed to have been, accessed, acquired, or disclosed during such breach. (c) Application of requirements for timeliness, method, and content of notifications Subsections (c), (d), (e), and (f) of section 17932 of this title shall apply to a notification re- quired under subsection (a) and a vendor of per- sonal health records, an entity described in sub- section (a) and a third party service provider de- scribed in subsection (b), with respect to a breach of security under subsection (a) of unse- cured PHR identifiable health information in such records maintained or offered by such ven- dor, in a manner specified by the Federal Trade Commission. (d) Notification of the Secretary Upon receipt of a notification of a breach of security under subsection (a)(2), the Federal Trade Commission shall notify the Secretary of such breach. (e) Enforcement A violation of subsection (a) or (b) shall be treated as an unfair and deceptive act or prac- tice in violation of a regulation under section 57a(a)(1)(B) of title 15 regarding unfair or decep- tive acts or practices. (f) Definitions For purposes of this section: (1) Breach of security The term ‘‘breach of security’’ means, with respect to unsecured PHR identifiable health information of an individual in a personal health record, acquisition of such information without the authorization of the individual. (2) PHR identifiable health information The term ‘‘PHR identifiable health informa- tion’’ means individually identifiable health information, as defined in section 1320d(6) of this title, and includes, with respect to an in- dividual, information— (A) that is provided by or on behalf of the individual; and (B) that identifies the individual or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual. (3) Unsecured PHR identifiable health infor- mation (A) In general Subject to subparagraph (B), the term ‘‘un- secured PHR identifiable health informa- tion’’ means PHR identifiable health infor- mation that is not protected through the use of a technology or methodology specified by the Secretary in the guidance issued under section 17932(h)(2) of this title. (B) Exception in case timely guidance not issued In the case that the Secretary does not issue guidance under section 17932(h)(2) of this title by the date specified in such sec- tion, for purposes of this section, the term ‘‘unsecured PHR identifiable health informa- tion’’ shall mean PHR identifiable health in- formation that is not secured by a tech- nology standard that renders protected health information unusable, unreadable, or indecipherable to unauthorized individuals and that is developed or endorsed by a stand- ards developing organization that is accred- ited by the American National Standards In- stitute. (g) Regulations; effective date; sunset (1) Regulations; effective date To carry out this section, the Federal Trade Commission shall promulgate interim final regulations by not later than the date that is 180 days after February 17, 2009. The provisions of this section shall apply to breaches of secu- rity that are discovered on or after the date that is 30 days after the date of publication of such interim final regulations. (2) Sunset If Congress enacts new legislation estab- lishing requirements for notification in the case of a breach of security, that apply to en- tities that are not covered entities or business associates, the provisions of this section shall not apply to breaches of security discovered on or after the effective date of regulations implementing such legislation. (Pub. L. 111–5, div. A, title XIII, § 13407, Feb. 17, 2009, 123 Stat. 269.) Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17938. Business associate contracts required for certain entities Each organization, with respect to a covered entity, that provides data transmission of pro- tected health information to such entity (or its business associate) and that requires access on a routine basis to such protected health informa- tion, such as a Health Information Exchange Or- ganization, Regional Health Information Orga- nization, E-prescribing Gateway, or each vendor that contracts with a covered entity to allow that covered entity to offer a personal health record to patients as part of its electronic health record, is required to enter into a written contract (or other written arrangement) de- scribed in section 164.502(e)(2) of title 45, Code of Federal Regulations and a written contract (or other arrangement) described in section Page 9077 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17940 1 So in original. Probably should be ‘‘this’’. 2 So in original. Probably should be ‘‘sections’’. 164.308(b) of such title, with such entity and shall be treated as a business associate of the covered entity for purposes of the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009. (Pub. L. 111–5, div. A, title XIII, § 13408, Feb. 17, 2009, 123 Stat. 271.) Editorial Notes REFERENCES IN TEXT This subchapter, referred to in text, was in the origi- nal ‘‘this subtitle’’, meaning subtitle D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123 Stat. 258, which is classified principally to this sub- chapter. For complete classification of subtitle D to the Code, see Tables. Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17939. Improved enforcement (a) In general (1) Omitted (2) Enforcement under Social Security Act Any violation by a covered entity under thus 1 subchapter is subject to enforcement and penalties under section 2 1176 and 1177 of the Social Security Act [42 U.S.C. 1320d–5, 1320d–6]. (b) Effective date; regulations (1) The amendments made by subsection (a) shall apply to penalties imposed on or after the date that is 24 months after February 17, 2009. (2) Not later than 18 months after February 17, 2009, the Secretary of Health and Human Serv- ices shall promulgate regulations to implement such amendments. (c) Distribution of certain civil monetary pen- alties collected (1) In general Subject to the regulation promulgated pur- suant to paragraph (3), any civil monetary penalty or monetary settlement collected with respect to an offense punishable under this subchapter or section 1176 of the Social Secu- rity Act (42 U.S.C. 1320d–5) insofar as such sec- tion relates to privacy or security shall be transferred to the Office for Civil Rights of the Department of Health and Human Services to be used for purposes of enforcing the provi- sions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regula- tions, as such provisions are in effect as of February 17, 2009. (2) GAO report Not later than 18 months after February 17, 2009, the Comptroller General shall submit to the Secretary a report including recommenda- tions for a methodology under which an indi- vidual who is harmed by an act that con- stitutes an offense referred to in paragraph (1) may receive a percentage of any civil mone- tary penalty or monetary settlement collected with respect to such offense. (3) Establishment of methodology to distribute percentage of CMPS collected to harmed individuals Not later than 3 years after February 17, 2009, the Secretary shall establish by regula- tion and based on the recommendations sub- mitted under paragraph (2), a methodology under which an individual who is harmed by an act that constitutes an offense referred to in paragraph (1) may receive a percentage of any civil monetary penalty or monetary set- tlement collected with respect to such offense. (4) Application of methodology The methodology under paragraph (3) shall be applied with respect to civil monetary pen- alties or monetary settlements imposed on or after the effective date of the regulation. (d) Tiered increase in amount of civil monetary penalties (1) to (3) Omitted (4) Effective date The amendments made by this subsection shall apply to violations occurring after Feb- ruary 17, 2009. (e) Enforcement through State attorneys general (1), (2) Omitted (3) Effective date The amendments made by this subsection shall apply to violations occurring after Feb- ruary 17, 2009. (Pub. L. 111–5, div. A, title XIII, § 13410, Feb. 17, 2009, 123 Stat. 271.) Editorial Notes REFERENCES IN TEXT This subchapter, referred to in subsecs. (a)(2) and (c)(1), was in the original ‘‘this subtitle’’, meaning sub- title D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123 Stat. 258, which is classified principally to this subchapter. For complete classifica- tion of subtitle D to the Code, see Tables. For reference to ‘‘the amendments made by sub- section (a)’’ in subsec. (b)(1) and ‘‘the amendments made by this subsection’’ in subsecs. (d)(4) and (e)(3), see Codification note below. CODIFICATION Section is comprised of section 13410 of Pub. L. 111–5. Subsecs. (a)(1), (d)(1)–(3), (e)(1), (2), and (f) of section 13410 of Pub. L. 111–5 amended section 1320d–5 of this title. Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17940. Audits The Secretary shall provide for periodic audits to ensure that covered entities and business as-