42 U.S.C. § 17937 — Temporary breach notification require-

Page 9075 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17937 1 See References in Text note below. 1 So in original. The period probably should be a comma. Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17936. Conditions on certain contacts as part of health care operations (a) Marketing (1) In general A communication by a covered entity or business associate that is about a product or service and that encourages recipients of the communication to purchase or use the product or service shall not be considered a health care operation for purposes of subpart E of part 164 of title 45, Code of Federal Regulations, unless the communication is made as described in subparagraph (i), (ii), or (iii) of paragraph (1) of the definition of marketing in section 164.501 of such title. (2) Payment for certain communications A communication by a covered entity or business associate that is described in sub- paragraph (i), (ii), or (iii) of paragraph (1) of the definition of marketing in section 164.501 of title 45, Code of Federal Regulations, shall not be considered a health care operation for purposes of subpart E of part 164 of title 45, Code of Federal Regulations if the covered en- tity receives or has received direct or indirect payment in exchange for making such commu- nication, except where— (A)(i) such communication describes only a drug or biologic that is currently being prescribed for the recipient of the commu- nication; and (ii) any payment received by such covered entity in exchange for making a communica- tion described in clause (i) is reasonable in amount; (B) each of the following conditions apply— (i) the communication is made by the covered entity; and (ii) the covered entity making such com- munication obtains from the recipient of the communication, in accordance with section 164.508 of title 45, Code of Federal Regulations, a valid authorization (as de- scribed in paragraph (b) of such section) with respect to such communication; or (C) each of the following conditions apply— (i) the communication is made by a busi- ness associate on behalf of the covered en- tity; and (ii) the communication is consistent with the written contract (or other writ- ten arrangement described in section 164.502(e)(2) of such title) between such business associate and covered entity. (3) Reasonable in amount defined For purposes of paragraph (2), the term ‘‘rea- sonable in amount’’ shall have the meaning given such term by the Secretary by regula- tion. (4) Direct or indirect payment For purposes of paragraph (2), the term ‘‘di- rect or indirect payment’’ shall not include any payment for treatment (as defined in sec- tion 164.501 of title 45, Code of Federal Regula- tions) of an individual. (b) Opportunity to opt out of fundraising The Secretary shall by rule provide that any written fundraising communication that is a healthcare operation as defined under section 164.501 of title 45, Code of Federal Regulations, shall, in a clear and conspicuous manner, pro- vide an opportunity for the recipient of the com- munications to elect not to receive any further such communication. When an individual elects not to receive any further such communication, such election shall be treated as a revocation of authorization under section 164.508 of title 45, Code of Federal Regulations. (c) Effective date This section shall apply to written commu- nications occurring on or after the effective date specified under section 13423.1 (Pub. L. 111–5, div. A, title XIII, § 13406, Feb. 17, 2009, 123 Stat. 268.) Editorial Notes REFERENCES IN TEXT Section 13423, referred to in subsec. (c), means section 13423 of div. A of Pub. L. 111–5, which is set out as an Effective Date note under section 17931 of this title. Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17937. Temporary breach notification require- ment for vendors of personal health records and other non-HIPAA covered entities (a) In general In accordance with subsection (c), each vendor of personal health records, following the dis- covery of a breach of security of unsecured PHR identifiable health information that is in a per- sonal health record maintained or offered by such vendor, and each entity described in clause (ii), (iii), or (iv) of section 17953(b)(1)(A) of this title, following the discovery of a breach of secu- rity of such information that is obtained through a product or service provided by such entity, shall— (1) notify each individual who is a citizen or resident of the United States whose unsecured PHR identifiable health information was ac- quired by an unauthorized person as a result of such a breach of security; and (2) notify the Federal Trade Commission. (b) Notification by third party service providers A third party service provider that provides services to a vendor of personal health records or to an entity described in clause (ii), (iii).1 or Page 9076 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17938 (iv) of section 17953(b)(1)(A) of this title in con- nection with the offering or maintenance of a personal health record or a related product or service and that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured PHR identifi- able health information in such a record as a re- sult of such services shall, following the dis- covery of a breach of security of such informa- tion, notify such vendor or entity, respectively, of such breach. Such notice shall include the identification of each individual whose unse- cured PHR identifiable health information has been, or is reasonably believed to have been, accessed, acquired, or disclosed during such breach. (c) Application of requirements for timeliness, method, and content of notifications Subsections (c), (d), (e), and (f) of section 17932 of this title shall apply to a notification re- quired under subsection (a) and a vendor of per- sonal health records, an entity described in sub- section (a) and a third party service provider de- scribed in subsection (b), with respect to a breach of security under subsection (a) of unse- cured PHR identifiable health information in such records maintained or offered by such ven- dor, in a manner specified by the Federal Trade Commission. (d) Notification of the Secretary Upon receipt of a notification of a breach of security under subsection (a)(2), the Federal Trade Commission shall notify the Secretary of such breach. (e) Enforcement A violation of subsection (a) or (b) shall be treated as an unfair and deceptive act or prac- tice in violation of a regulation under section 57a(a)(1)(B) of title 15 regarding unfair or decep- tive acts or practices. (f) Definitions For purposes of this section: (1) Breach of security The term ‘‘breach of security’’ means, with respect to unsecured PHR identifiable health information of an individual in a personal health record, acquisition of such information without the authorization of the individual. (2) PHR identifiable health information The term ‘‘PHR identifiable health informa- tion’’ means individually identifiable health information, as defined in section 1320d(6) of this title, and includes, with respect to an in- dividual, information— (A) that is provided by or on behalf of the individual; and (B) that identifies the individual or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual. (3) Unsecured PHR identifiable health infor- mation (A) In general Subject to subparagraph (B), the term ‘‘un- secured PHR identifiable health informa- tion’’ means PHR identifiable health infor- mation that is not protected through the use of a technology or methodology specified by the Secretary in the guidance issued under section 17932(h)(2) of this title. (B) Exception in case timely guidance not issued In the case that the Secretary does not issue guidance under section 17932(h)(2) of this title by the date specified in such sec- tion, for purposes of this section, the term ‘‘unsecured PHR identifiable health informa- tion’’ shall mean PHR identifiable health in- formation that is not secured by a tech- nology standard that renders protected health information unusable, unreadable, or indecipherable to unauthorized individuals and that is developed or endorsed by a stand- ards developing organization that is accred- ited by the American National Standards In- stitute. (g) Regulations; effective date; sunset (1) Regulations; effective date To carry out this section, the Federal Trade Commission shall promulgate interim final regulations by not later than the date that is 180 days after February 17, 2009. The provisions of this section shall apply to breaches of secu- rity that are discovered on or after the date that is 30 days after the date of publication of such interim final regulations. (2) Sunset If Congress enacts new legislation estab- lishing requirements for notification in the case of a breach of security, that apply to en- tities that are not covered entities or business associates, the provisions of this section shall not apply to breaches of security discovered on or after the effective date of regulations implementing such legislation. (Pub. L. 111–5, div. A, title XIII, § 13407, Feb. 17, 2009, 123 Stat. 269.) Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17938. Business associate contracts required for certain entities Each organization, with respect to a covered entity, that provides data transmission of pro- tected health information to such entity (or its business associate) and that requires access on a routine basis to such protected health informa- tion, such as a Health Information Exchange Or- ganization, Regional Health Information Orga- nization, E-prescribing Gateway, or each vendor that contracts with a covered entity to allow that covered entity to offer a personal health record to patients as part of its electronic health record, is required to enter into a written contract (or other written arrangement) de- scribed in section 164.502(e)(2) of title 45, Code of Federal Regulations and a written contract (or other arrangement) described in section