42 U.S.C. § 17935 — Restrictions on certain disclosures and

Page 9072 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17934 develop and maintain a multi-faceted national education initiative to enhance public trans- parency regarding the uses of protected health information, including programs to educate in- dividuals about the potential uses of their pro- tected health information, the effects of such uses, and the rights of individuals with respect to such uses. Such programs shall be conducted in a variety of languages and present informa- tion in a clear and understandable manner. (Pub. L. 111–5, div. A, title XIII, § 13403, Feb. 17, 2009, 123 Stat. 263.) Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17934. Application of privacy provisions and penalties to business associates of covered entities (a) Application of contract requirements In the case of a business associate of a covered entity that obtains or creates protected health information pursuant to a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regula- tions, with such covered entity, the business as- sociate may use and disclose such protected health information only if such use or disclo- sure, respectively, is in compliance with each applicable requirement of section 164.504(e) of such title. The additional requirements of this subchapter that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to such a business asso- ciate and shall be incorporated into the business associate agreement between the business asso- ciate and the covered entity. (b) Application of knowledge elements associated with contracts Section 164.504(e)(1)(ii) of title 45, Code of Fed- eral Regulations, shall apply to a business asso- ciate described in subsection (a), with respect to compliance with such subsection, in the same manner that such section applies to a covered entity, with respect to compliance with the standards in sections 164.502(e) and 164.504(e) of such title, except that in applying such section 164.504(e)(1)(ii) each reference to the business as- sociate, with respect to a contract, shall be treated as a reference to the covered entity in- volved in such contract. (c) Application of civil and criminal penalties In the case of a business associate that vio- lates any provision of subsection (a) or (b), the provisions of sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d–5, 1320d–6) shall apply to the business associate with respect to such violation in the same manner as such pro- visions apply to a person who violates a provi- sion of part C of title XI of such Act [42 U.S.C. 1320d et seq.]. (Pub. L. 111–5, div. A, title XIII, § 13404, Feb. 17, 2009, 123 Stat. 264.) Editorial Notes REFERENCES IN TEXT This subchapter, referred to in subsec. (a), was in the original ‘‘this subtitle’’, meaning subtitle D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123 Stat. 258, which is classified principally to this sub- chapter. For complete classification of subtitle D to the Code, see Tables. The Social Security Act, referred to in subsec. (c), is act Aug. 14, 1935, ch. 531, 49 Stat. 620. Part C of title XI of the Act is classified generally to part C (§ 1320d et seq.) of subchapter XI of chapter 7 of this title. For complete classification of this Act to the Code, see sec- tion 1305 of this title and Tables. Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17935. Restrictions on certain disclosures and sales of health information; accounting of certain protected health information disclo- sures; access to certain information in elec- tronic format (a) Requested restrictions on certain disclosures of health information In the case that an individual requests under paragraph (a)(1)(i)(A) of section 164.522 of title 45, Code of Federal Regulations, that a covered entity restrict the disclosure of the protected health information of the individual, notwith- standing paragraph (a)(1)(ii) of such section, the covered entity must comply with the requested restriction if— (1) except as otherwise required by law, the disclosure is to a health plan for purposes of carrying out payment or health care oper- ations (and is not for purposes of carrying out treatment); and (2) the protected health information pertains solely to a health care item or service for which the health care provider involved has been paid out of pocket in full. (b) Disclosures required to be limited to the lim- ited data set or the minimum necessary (1) In general (A) In general Subject to subparagraph (B), a covered en- tity shall be treated as being in compliance with section 164.502(b)(1) of title 45, Code of Federal Regulations, with respect to the use, disclosure, or request of protected health in- formation described in such section, only if the covered entity limits such protected health information, to the extent prac- ticable, to the limited data set (as defined in section 164.514(e)(2) of such title) or, if need- ed by such entity, to the minimum nec- essary to accomplish the intended purpose of such use, disclosure, or request, respec- tively. (B) Guidance Not later than 18 months after February 17, 2009, the Secretary shall issue guidance on what constitutes ‘‘minimum necessary’’ Page 9073 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17935 1 So in original. Probably should be ‘‘Regulations.’’ 2 See References in Text note below. 3 So in original. 4 So in original. Probably should be ‘‘a’’. 5 So in original. Probably should be ‘‘than’’. for purposes of subpart E of part 164 of title 45, Code of Federal Regulation.1 In issuing such guidance the Secretary shall take into consideration the guidance under section 17953(c) of this title and the information nec- essary to improve patient outcomes and to detect, prevent, and manage chronic disease. (C) Sunset Subparagraph (A) shall not apply on and after the effective date on which the Sec- retary issues the guidance under subpara- graph (B). (2) Determination of minimum necessary For purposes of paragraph (1), in the case of the disclosure of protected health information, the covered entity or business associate dis- closing such information shall determine what constitutes the minimum necessary to accom- plish the intended purpose of such disclosure. (3) Application of exceptions The exceptions described in section 164.502(b)(2) of title 45, Code of Federal Regula- tions, shall apply to the requirement under paragraph (1) as of the effective date described in section 13423 2 in the same manner that such exceptions apply to section 164.502(b)(1) of such title before such date. (4) Rule of construction Nothing in this subsection shall be con- strued as affecting the use, disclosure, or re- quest of protected health information that has been de-identified. (c) Accounting of certain protected health infor- mation disclosures required if covered entity uses electronic health record (1) In general In applying section 164.528 of title 45, Code of Federal Regulations, in the case that a cov- ered entity uses or maintains an electronic health record with respect to protected health information— (A) the exception under paragraph (a)(1)(i) of such section shall not apply to disclosures through an electronic health record made by such entity of such information; and (B) an individual shall have a right to re- ceive an accounting of disclosures described in such paragraph of such information made by such covered entity during only the three years prior to the date on which the ac- counting is requested. (2) Regulations The Secretary shall promulgate regulations on what information shall be collected about each disclosure referred to in paragraph (1), not later than 6 months after the date on which the Secretary adopts standards on ac- counting for disclosure described in the 3 sec- tion 300jj–12(b)(2)(B)(iv) of this title, as added by section 13101.2 Such regulations shall only require such information to be collected through an electronic health record in a man- ner that takes into account the interests of the individuals in learning the circumstances under which their protected health informa- tion is being disclosed and takes into account the administrative burden of accounting for such disclosures. (3) Process In response to an 4 request from an indi- vidual for an accounting, a covered entity shall elect to provide either an— (A) accounting, as specified under para- graph (1), for disclosures of protected health information that are made by such covered entity and by a business associate acting on behalf of the covered entity; or (B) accounting, as specified under para- graph (1), for disclosures that are made by such covered entity and provide a list of all business associates acting on behalf of the covered entity, including contact informa- tion for such associates (such as mailing ad- dress, phone, and email address). A business associate included on a list under subparagraph (B) shall provide an accounting of disclosures (as required under paragraph (1) for a covered entity) made by the business as- sociate upon a request made by an individual directly to the business associate for such an accounting. (4) Effective date (A) Current users of electronic records In the case of a covered entity insofar as it acquired an electronic health record as of January 1, 2009, paragraph (1) shall apply to disclosures, with respect to protected health information, made by the covered entity from such a record on and after January 1, 2014. (B) Others In the case of a covered entity insofar as it acquires an electronic health record after January 1, 2009, paragraph (1) shall apply to disclosures, with respect to protected health information, made by the covered entity from such record on and after the later of the following: (i) January 1, 2011; or (ii) the date that it acquires an elec- tronic health record. (C) Later date The Secretary may set an effective date that is later that 5 the date specified under subparagraph (A) or (B) if the Secretary de- termines that such later date is necessary, but in no case may the date specified under— (i) subparagraph (A) be later than 2016; or (ii) subparagraph (B) be later than 2013. (d) Prohibition on sale of electronic health records or protected health information (1) In general Except as provided in paragraph (2), a cov- ered entity or business associate shall not di- rectly or indirectly receive remuneration in Page 9074 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17935 exchange for any protected health information of an individual unless the covered entity ob- tained from the individual, in accordance with section 164.508 of title 45, Code of Federal Reg- ulations, a valid authorization that includes, in accordance with such section, a specifica- tion of whether the protected health informa- tion can be further exchanged for remunera- tion by the entity receiving protected health information of that individual. (2) Exceptions Paragraph (1) shall not apply in the fol- lowing cases: (A) The purpose of the exchange is for pub- lic health activities (as described in section 164.512(b) of title 45, Code of Federal Regula- tions). (B) The purpose of the exchange is for re- search (as described in sections 164.501 and 164.512(i) of title 45, Code of Federal Regula- tions) and the price charged reflects the costs of preparation and transmittal of the data for such purpose. (C) The purpose of the exchange is for the treatment of the individual, subject to any regulation that the Secretary may promul- gate to prevent protected health informa- tion from inappropriate access, use, or dis- closure. (D) The purpose of the exchange is the health care operation specifically described in subparagraph (iv) of paragraph (6) of the definition of healthcare operations in sec- tion 164.501 of title 45, Code of Federal Regu- lations. (E) The purpose of the exchange is for re- muneration that is provided by a covered en- tity to a business associate for activities in- volving the exchange of protected health in- formation that the business associate under- takes on behalf of and at the specific request of the covered entity pursuant to a business associate agreement. (F) The purpose of the exchange is to pro- vide an individual with a copy of the individ- ual’s protected health information pursuant to section 164.524 of title 45, Code of Federal Regulations. (G) The purpose of the exchange is other- wise determined by the Secretary in regula- tions to be similarly necessary and appro- priate as the exceptions provided in subpara- graphs (A) through (F). (3) Regulations Not later than 18 months after February 17, 2009, the Secretary shall promulgate regula- tions to carry out this subsection. In promul- gating such regulations, the Secretary— (A) shall evaluate the impact of restricting the exception described in paragraph (2)(A) to require that the price charged for the pur- poses described in such paragraph reflects the costs of the preparation and transmittal of the data for such purpose, on research or public health activities, including those con- ducted by or for the use of the Food and Drug Administration; and (B) may further restrict the exception de- scribed in paragraph (2)(A) to require that the price charged for the purposes described in such paragraph reflects the costs of the preparation and transmittal of the data for such purpose, if the Secretary finds that such further restriction will not impede such research or public health activities. (4) Effective date Paragraph (1) shall apply to exchanges oc- curring on or after the date that is 6 months after the date of the promulgation of final reg- ulations implementing this subsection. (e) Access to certain information in electronic format In applying section 164.524 of title 45, Code of Federal Regulations, in the case that a covered entity uses or maintains an electronic health record with respect to protected health informa- tion of an individual— (1) the individual shall have a right to ob- tain from such covered entity a copy of such information in an electronic format and, if the individual chooses, to direct the covered enti- ty to transmit such copy directly to an entity or person designated by the individual, pro- vided that any such choice is clear, con- spicuous, and specific; (2) if the individual makes a request to a business associate for access to, or a copy of, protected health information about the indi- vidual, or if an individual makes a request to a business associate to grant such access to, or transmit such copy directly to, a person or en- tity designated by the individual, a business associate may provide the individual with such access or copy, which may be in an elec- tronic form, or grant or transmit such access or copy to such person or entity designated by the individual; and (3) notwithstanding paragraph (c)(4) of such section, any fee that the covered entity may impose for providing such individual with a copy of such information (or a summary or ex- planation of such information) if such copy (or summary or explanation) is in an electronic form shall not be greater than the entity’s labor costs in responding to the request for the copy (or summary or explanation). (Pub. L. 111–5, div. A, title XIII, § 13405, Feb. 17, 2009, 123 Stat. 264; Pub. L. 114–255, div. A, title IV, § 4006(b), Dec. 13, 2016, 130 Stat. 1183.) Editorial Notes REFERENCES IN TEXT Section 13423, referred to in subsec. (b)(3), means sec- tion 13423 of div. A of Pub. L. 111–5, which is set out as an Effective Date note under section 17931 of this title. Section 300jj–12(b)(2)(B)(iv) of this title, as added by section 13101, referred to in subsec. (c)(2), means section 300jj–12(b)(2)(B)(iv) of this title as added by section 13101 of div. A of Pub. L. 111–5. Section 300jj–12 of this title was repealed by Pub. L. 114–255, div. A, title IV, § 4003(e)(1), Dec. 13, 2016, 130 Stat. 1168. Similar provi- sions as pertaining to the HIT Advisory Committee are contained in section 300jj–12(b)(2)(B)(ii) of this title as enacted by Pub. L. 114–255. AMENDMENTS 2016—Subsec. (e)(2), (3). Pub. L. 114–255 added par. (2) and redesignated former par. (2) as (3). Page 9075 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17937 1 See References in Text note below. 1 So in original. The period probably should be a comma. Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17936. Conditions on certain contacts as part of health care operations (a) Marketing (1) In general A communication by a covered entity or business associate that is about a product or service and that encourages recipients of the communication to purchase or use the product or service shall not be considered a health care operation for purposes of subpart E of part 164 of title 45, Code of Federal Regulations, unless the communication is made as described in subparagraph (i), (ii), or (iii) of paragraph (1) of the definition of marketing in section 164.501 of such title. (2) Payment for certain communications A communication by a covered entity or business associate that is described in sub- paragraph (i), (ii), or (iii) of paragraph (1) of the definition of marketing in section 164.501 of title 45, Code of Federal Regulations, shall not be considered a health care operation for purposes of subpart E of part 164 of title 45, Code of Federal Regulations if the covered en- tity receives or has received direct or indirect payment in exchange for making such commu- nication, except where— (A)(i) such communication describes only a drug or biologic that is currently being prescribed for the recipient of the commu- nication; and (ii) any payment received by such covered entity in exchange for making a communica- tion described in clause (i) is reasonable in amount; (B) each of the following conditions apply— (i) the communication is made by the covered entity; and (ii) the covered entity making such com- munication obtains from the recipient of the communication, in accordance with section 164.508 of title 45, Code of Federal Regulations, a valid authorization (as de- scribed in paragraph (b) of such section) with respect to such communication; or (C) each of the following conditions apply— (i) the communication is made by a busi- ness associate on behalf of the covered en- tity; and (ii) the communication is consistent with the written contract (or other writ- ten arrangement described in section 164.502(e)(2) of such title) between such business associate and covered entity. (3) Reasonable in amount defined For purposes of paragraph (2), the term ‘‘rea- sonable in amount’’ shall have the meaning given such term by the Secretary by regula- tion. (4) Direct or indirect payment For purposes of paragraph (2), the term ‘‘di- rect or indirect payment’’ shall not include any payment for treatment (as defined in sec- tion 164.501 of title 45, Code of Federal Regula- tions) of an individual. (b) Opportunity to opt out of fundraising The Secretary shall by rule provide that any written fundraising communication that is a healthcare operation as defined under section 164.501 of title 45, Code of Federal Regulations, shall, in a clear and conspicuous manner, pro- vide an opportunity for the recipient of the com- munications to elect not to receive any further such communication. When an individual elects not to receive any further such communication, such election shall be treated as a revocation of authorization under section 164.508 of title 45, Code of Federal Regulations. (c) Effective date This section shall apply to written commu- nications occurring on or after the effective date specified under section 13423.1 (Pub. L. 111–5, div. A, title XIII, § 13406, Feb. 17, 2009, 123 Stat. 268.) Editorial Notes REFERENCES IN TEXT Section 13423, referred to in subsec. (c), means section 13423 of div. A of Pub. L. 111–5, which is set out as an Effective Date note under section 17931 of this title. Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17937. Temporary breach notification require- ment for vendors of personal health records and other non-HIPAA covered entities (a) In general In accordance with subsection (c), each vendor of personal health records, following the dis- covery of a breach of security of unsecured PHR identifiable health information that is in a per- sonal health record maintained or offered by such vendor, and each entity described in clause (ii), (iii), or (iv) of section 17953(b)(1)(A) of this title, following the discovery of a breach of secu- rity of such information that is obtained through a product or service provided by such entity, shall— (1) notify each individual who is a citizen or resident of the United States whose unsecured PHR identifiable health information was ac- quired by an unauthorized person as a result of such a breach of security; and (2) notify the Federal Trade Commission. (b) Notification by third party service providers A third party service provider that provides services to a vendor of personal health records or to an entity described in clause (ii), (iii).1 or