42 U.S.C. § 17921 — Definitions

Page 9068 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17921 1 So in original. Probably should be followed by ‘‘the’’. 2 See References in Text note below. (5) Applications An institution of higher education (or a con- sortium thereof) seeking funding under this subsection shall submit an application to the Director of the National Institute of Stand- ards and Technology at such time, in such manner, and containing such information as the Director may require. The application shall include, at a minimum, a description of— (A) the research projects that will be un- dertaken by the Center established pursuant to assistance under paragraph (1) and the re- spective contributions of the participating entities; (B) how the Center will promote active collaboration among scientists and engi- neers from different disciplines, such as in- formation technology, biologic sciences, management, social sciences, and other ap- propriate disciplines; (C) technology transfer activities to dem- onstrate and diffuse the research results, technologies, and knowledge; and (D) how the Center will contribute to the education and training of researchers and other professionals in fields relevant to health information enterprise integration. (b) National information technology research and development program The Networking and Information Technology Research and Development Program established by section 5511 of title 15 shall include Federal research and development programs related to health information technology. (Pub. L. 111–5, div. A, title XIII, § 13202, Feb. 17, 2009, 123 Stat. 245; Pub. L. 114–329, title I, § 105(s), Jan. 6, 2017, 130 Stat. 2985.) Editorial Notes AMENDMENTS 2017—Subsec. (b). Pub. L. 114–329 substituted ‘‘Net- working and Information Technology Research and De- velopment Program’’ for ‘‘National High-Performance Computing Program’’. SUBCHAPTER III—PRIVACY § 17921. Definitions In this subchapter, except as specified other- wise: (1) Breach (A) In general The term ‘‘breach’’ means the unauthor- ized acquisition, access, use, or disclosure of protected health information which com- promises the security or privacy of such in- formation, except where an unauthorized person to whom such information is dis- closed would not reasonably have been able to retain such information. (B) Exceptions The term ‘‘breach’’ does not include— (i) any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if— (I) such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such em- ployee or individual, respectively, with the covered entity or business associate; and (II) such information is not further ac- quired, accessed, used, or disclosed by any person; or (ii) any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly sit- uated individual at 1 same facility; and (iii) any such information received as a result of such disclosure is not further ac- quired, accessed, used, or disclosed with- out authorization by any person. (2) Business associate The term ‘‘business associate’’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (3) Covered entity The term ‘‘covered entity’’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (4) Disclose The terms ‘‘disclose’’ and ‘‘disclosure’’ have the meaning given the term ‘‘disclosure’’ in section 160.103 of title 45, Code of Federal Reg- ulations. (5) Electronic health record The term ‘‘electronic health record’’ means an electronic record of health-related informa- tion on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff. (6) Health care operations The term ‘‘health care operation’’ has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. (7) Health care provider The term ‘‘health care provider’’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (8) Health plan The term ‘‘health plan’’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (9) National Coordinator The term ‘‘National Coordinator’’ means the head of the Office of the National Coordinator for Health Information Technology estab- lished under section 300jj–11(a) of this title, as added by section 13101.2 (10) Payment The term ‘‘payment’’ has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. (11) Personal health record The term ‘‘personal health record’’ means an electronic record of PHR identifiable health Page 9069 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17932 1 See References in Text note below. information (as defined in section 17937(f)(2) of this title) on an individual that can be drawn from multiple sources and that is managed, shared, and controlled by or primarily for the individual. (12) Protected health information The term ‘‘protected health information’’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (13) Secretary The term ‘‘Secretary’’ means the Secretary of Health and Human Services. (14) Security The term ‘‘security’’ has the meaning given such term in section 164.304 of title 45, Code of Federal Regulations. (15) State The term ‘‘State’’ means each of the several States, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands. (16) Treatment The term ‘‘treatment’’ has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. (17) Use The term ‘‘use’’ has the meaning given such term in section 160.103 of title 45, Code of Fed- eral Regulations. (18) Vendor of personal health records The term ‘‘vendor of personal health records’’ means an entity, other than a cov- ered entity (as defined in paragraph (3)), that offers or maintains a personal health record. (Pub. L. 111–5, div. A, title XIII, § 13400, Feb. 17, 2009, 123 Stat. 258.) Editorial Notes REFERENCES IN TEXT This subchapter, referred to in text, was in the origi- nal ‘‘this subtitle’’, meaning subtitle D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123 Stat. 258, which is classified principally to this sub- chapter. For complete classification of subtitle D to the Code, see Tables. Section 13101, referred to in par. (9), means section 13101 of div. A of Pub. L. 111–5. PART A—IMPROVED PRIVACY PROVISIONS AND SECURITY PROVISIONS § 17931. Application of security provisions and penalties to business associates of covered entities; annual guidance on security provi- sions (a) Application of security provisions Sections 164.308, 164.310, 164.312, and 164.316 of title 45, Code of Federal Regulations, shall apply to a business associate of a covered entity in the same manner that such sections apply to the covered entity. The additional requirements of this title 1 that relate to security and that are made applicable with respect to covered entities shall also be applicable to such a business asso- ciate and shall be incorporated into the business associate agreement between the business asso- ciate and the covered entity. (b) Application of civil and criminal penalties In the case of a business associate that vio- lates any security provision specified in sub- section (a), sections 1320d–5 and 1320d–6 of this title shall apply to the business associate with respect to such violation in the same manner such sections apply to a covered entity that vio- lates such security provision. (c) Annual guidance For the first year beginning after February 17, 2009, and annually thereafter, the Secretary of Health and Human Services shall, after con- sultation with stakeholders, annually issue guidance on the most effective and appropriate technical safeguards for use in carrying out the sections referred to in subsection (a) and the se- curity standards in subpart C of part 164 of title 45, Code of Federal Regulations, including the use of standards developed under section 300jj–12(b)(2)(B)(vi) 1 of this title, as added by section 13101 of this Act, as such provisions are in effect as of the date before February 17, 2009. (Pub. L. 111–5, div. A, title XIII, § 13401, Feb. 17, 2009, 123 Stat. 260.) Editorial Notes REFERENCES IN TEXT This title, referred to in subsec. (a), is title XIII of div. A of Pub. L. 111–5, which enacted this chapter and subchapter XXVIII (§ 300jj et seq.) of chapter 6A this title, amended sections 1320d, 1320d–5, and 1320d–6 of this title, and enacted provisions set out as a note under this section and section 201 of this title. For complete classification of title XIII to the Code, see Short Title of 2009 Amendment note set out under sec- tion 201 of this title and Tables. Section 300jj–12(b)(2)(B)(vi) of this title, referred to in subsec. (c), was repealed by Pub. L. 114–255, div. A, title IV, § 4003(e)(1), Dec. 13, 2016, 130 Stat. 1168. Similar pro- visions as pertaining to the HIT Advisory Committee are contained in section 300jj–12(b)(2)(C)(vii) of this title as enacted by Pub. L. 114–255. Section 13101 of this Act, referred to in subsec. (c), means section 13101 of div. A of Pub. L. 111–5. Statutory Notes and Related Subsidiaries EFFECTIVE DATE Pub. L. 111–5, div. A, title XIII, § 13423, Feb. 17, 2009, 123 Stat. 276, provided that: ‘‘Except as otherwise spe- cifically provided, the provisions of part I [probably means part 1 (§§ 13401–13411) of subtitle D of title XIII of div. A of Pub. L. 111–5, enacting this part and amending sections 1320d–5 and 1320d–6 of this title] shall take ef- fect on the date that is 12 months after the date of the enactment of this title [Feb. 17, 2009].’’ § 17932. Notification in the case of breach (a) In general A covered entity that accesses, maintains, re- tains, modifies, records, stores, destroys, or oth- erwise holds, uses, or discloses unsecured pro- tected health information (as defined in sub- section (h)(1)) shall, in the case of a breach of such information that is discovered by the cov- ered entity, notify each individual whose unse-