42 U.S.C. § 17934 — Application of privacy provisions and

Page 9072 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17934 develop and maintain a multi-faceted national education initiative to enhance public trans- parency regarding the uses of protected health information, including programs to educate in- dividuals about the potential uses of their pro- tected health information, the effects of such uses, and the rights of individuals with respect to such uses. Such programs shall be conducted in a variety of languages and present informa- tion in a clear and understandable manner. (Pub. L. 111–5, div. A, title XIII, § 13403, Feb. 17, 2009, 123 Stat. 263.) Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17934. Application of privacy provisions and penalties to business associates of covered entities (a) Application of contract requirements In the case of a business associate of a covered entity that obtains or creates protected health information pursuant to a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regula- tions, with such covered entity, the business as- sociate may use and disclose such protected health information only if such use or disclo- sure, respectively, is in compliance with each applicable requirement of section 164.504(e) of such title. The additional requirements of this subchapter that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to such a business asso- ciate and shall be incorporated into the business associate agreement between the business asso- ciate and the covered entity. (b) Application of knowledge elements associated with contracts Section 164.504(e)(1)(ii) of title 45, Code of Fed- eral Regulations, shall apply to a business asso- ciate described in subsection (a), with respect to compliance with such subsection, in the same manner that such section applies to a covered entity, with respect to compliance with the standards in sections 164.502(e) and 164.504(e) of such title, except that in applying such section 164.504(e)(1)(ii) each reference to the business as- sociate, with respect to a contract, shall be treated as a reference to the covered entity in- volved in such contract. (c) Application of civil and criminal penalties In the case of a business associate that vio- lates any provision of subsection (a) or (b), the provisions of sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d–5, 1320d–6) shall apply to the business associate with respect to such violation in the same manner as such pro- visions apply to a person who violates a provi- sion of part C of title XI of such Act [42 U.S.C. 1320d et seq.]. (Pub. L. 111–5, div. A, title XIII, § 13404, Feb. 17, 2009, 123 Stat. 264.) Editorial Notes REFERENCES IN TEXT This subchapter, referred to in subsec. (a), was in the original ‘‘this subtitle’’, meaning subtitle D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123 Stat. 258, which is classified principally to this sub- chapter. For complete classification of subtitle D to the Code, see Tables. The Social Security Act, referred to in subsec. (c), is act Aug. 14, 1935, ch. 531, 49 Stat. 620. Part C of title XI of the Act is classified generally to part C (§ 1320d et seq.) of subchapter XI of chapter 7 of this title. For complete classification of this Act to the Code, see sec- tion 1305 of this title and Tables. Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17935. Restrictions on certain disclosures and sales of health information; accounting of certain protected health information disclo- sures; access to certain information in elec- tronic format (a) Requested restrictions on certain disclosures of health information In the case that an individual requests under paragraph (a)(1)(i)(A) of section 164.522 of title 45, Code of Federal Regulations, that a covered entity restrict the disclosure of the protected health information of the individual, notwith- standing paragraph (a)(1)(ii) of such section, the covered entity must comply with the requested restriction if— (1) except as otherwise required by law, the disclosure is to a health plan for purposes of carrying out payment or health care oper- ations (and is not for purposes of carrying out treatment); and (2) the protected health information pertains solely to a health care item or service for which the health care provider involved has been paid out of pocket in full. (b) Disclosures required to be limited to the lim- ited data set or the minimum necessary (1) In general (A) In general Subject to subparagraph (B), a covered en- tity shall be treated as being in compliance with section 164.502(b)(1) of title 45, Code of Federal Regulations, with respect to the use, disclosure, or request of protected health in- formation described in such section, only if the covered entity limits such protected health information, to the extent prac- ticable, to the limited data set (as defined in section 164.514(e)(2) of such title) or, if need- ed by such entity, to the minimum nec- essary to accomplish the intended purpose of such use, disclosure, or request, respec- tively. (B) Guidance Not later than 18 months after February 17, 2009, the Secretary shall issue guidance on what constitutes ‘‘minimum necessary’’