42 U.S.C. § 17933 — Education on health information privacy

Page 9071 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17933 2 See References in Text note below. volved in the breach (such as full name, Social Security number, date of birth, home address, account number, or disability code). (3) The steps individuals should take to pro- tect themselves from potential harm resulting from the breach. (4) A brief description of what the covered entity involved is doing to investigate the breach, to mitigate losses, and to protect against any further breaches. (5) Contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free telephone num- ber, an e-mail address, Web site, or postal ad- dress. (g) Delay of notification authorized for law en- forcement purposes If a law enforcement official determines that a notification, notice, or posting required under this section would impede a criminal investiga- tion or cause damage to national security, such notification, notice, or posting shall be delayed in the same manner as provided under section 164.528(a)(2) of title 45, Code of Federal Regula- tions, in the case of a disclosure covered under such section. (h) Unsecured protected health information (1) Definition (A) In general Subject to subparagraph (B), for purposes of this section, the term ‘‘unsecured pro- tected health information’’ means protected health information that is not secured through the use of a technology or method- ology specified by the Secretary in the guid- ance issued under paragraph (2). (B) Exception in case timely guidance not issued In the case that the Secretary does not issue guidance under paragraph (2) by the date specified in such paragraph, for pur- poses of this section, the term ‘‘unsecured protected health information’’ shall mean protected health information that is not se- cured by a technology standard that renders protected health information unusable, unreadable, or indecipherable to unauthor- ized individuals and is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute. (2) Guidance For purposes of paragraph (1) and section 17937(f)(3) of this title, not later than the date that is 60 days after February 17, 2009, the Sec- retary shall, after consultation with stake- holders, issue (and annually update) guidance specifying the technologies and methodologies that render protected health information un- usable, unreadable, or indecipherable to unau- thorized individuals, including the use of standards developed under section 300jj–12(b)(2)(B)(vi) 2 of this title, as added by section 13101 of this Act. (i) Report to Congress on breaches (1) In general Not later than 12 months after February 17, 2009, and annually thereafter, the Secretary shall prepare and submit to the Committee on Finance and the Committee on Health, Edu- cation, Labor, and Pensions of the Senate and the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives a report containing the information described in paragraph (2) re- garding breaches for which notice was pro- vided to the Secretary under subsection (e)(3). (2) Information The information described in this paragraph regarding breaches specified in paragraph (1) shall include— (A) the number and nature of such breaches; and (B) actions taken in response to such breaches. (j) Regulations; effective date To carry out this section, the Secretary of Health and Human Services shall promulgate in- terim final regulations by not later than the date that is 180 days after February 17, 2009. The provisions of this section shall apply to breaches that are discovered on or after the date that is 30 days after the date of publication of such in- terim final regulations. (Pub. L. 111–5, div. A, title XIII, § 13402, Feb. 17, 2009, 123 Stat. 260.) Editorial Notes REFERENCES IN TEXT Section 300jj–12(b)(2)(B)(vi) of this title, referred to in subsec. (h)(2), was repealed by Pub. L. 114–255, div. A, title IV, § 4003(e)(1), Dec. 13, 2016, 130 Stat. 1168. Similar provisions as pertaining to the HIT Advisory Com- mittee are contained in section 300jj–12(b)(2)(C)(vii) of this title as enacted by Pub. L. 114–255. Section 13101 of this Act, referred to in subsec. (h)(2), means section 13101 of div. A of Pub. L. 111–5. Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17933. Education on health information privacy (a) Regional office privacy advisors Not later than 6 months after February 17, 2009, the Secretary shall designate an individual in each regional office of the Department of Health and Human Services to offer guidance and education to covered entities, business asso- ciates, and individuals on their rights and re- sponsibilities related to Federal privacy and se- curity requirements for protected health infor- mation. (b) Education initiative on uses of health infor- mation Not later than 12 months after February 17, 2009, the Office for Civil Rights within the De- partment of Health and Human Services shall Page 9072 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 17934 develop and maintain a multi-faceted national education initiative to enhance public trans- parency regarding the uses of protected health information, including programs to educate in- dividuals about the potential uses of their pro- tected health information, the effects of such uses, and the rights of individuals with respect to such uses. Such programs shall be conducted in a variety of languages and present informa- tion in a clear and understandable manner. (Pub. L. 111–5, div. A, title XIII, § 13403, Feb. 17, 2009, 123 Stat. 263.) Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17934. Application of privacy provisions and penalties to business associates of covered entities (a) Application of contract requirements In the case of a business associate of a covered entity that obtains or creates protected health information pursuant to a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regula- tions, with such covered entity, the business as- sociate may use and disclose such protected health information only if such use or disclo- sure, respectively, is in compliance with each applicable requirement of section 164.504(e) of such title. The additional requirements of this subchapter that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to such a business asso- ciate and shall be incorporated into the business associate agreement between the business asso- ciate and the covered entity. (b) Application of knowledge elements associated with contracts Section 164.504(e)(1)(ii) of title 45, Code of Fed- eral Regulations, shall apply to a business asso- ciate described in subsection (a), with respect to compliance with such subsection, in the same manner that such section applies to a covered entity, with respect to compliance with the standards in sections 164.502(e) and 164.504(e) of such title, except that in applying such section 164.504(e)(1)(ii) each reference to the business as- sociate, with respect to a contract, shall be treated as a reference to the covered entity in- volved in such contract. (c) Application of civil and criminal penalties In the case of a business associate that vio- lates any provision of subsection (a) or (b), the provisions of sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d–5, 1320d–6) shall apply to the business associate with respect to such violation in the same manner as such pro- visions apply to a person who violates a provi- sion of part C of title XI of such Act [42 U.S.C. 1320d et seq.]. (Pub. L. 111–5, div. A, title XIII, § 13404, Feb. 17, 2009, 123 Stat. 264.) Editorial Notes REFERENCES IN TEXT This subchapter, referred to in subsec. (a), was in the original ‘‘this subtitle’’, meaning subtitle D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123 Stat. 258, which is classified principally to this sub- chapter. For complete classification of subtitle D to the Code, see Tables. The Social Security Act, referred to in subsec. (c), is act Aug. 14, 1935, ch. 531, 49 Stat. 620. Part C of title XI of the Act is classified generally to part C (§ 1320d et seq.) of subchapter XI of chapter 7 of this title. For complete classification of this Act to the Code, see sec- tion 1305 of this title and Tables. Statutory Notes and Related Subsidiaries EFFECTIVE DATE Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title. § 17935. Restrictions on certain disclosures and sales of health information; accounting of certain protected health information disclo- sures; access to certain information in elec- tronic format (a) Requested restrictions on certain disclosures of health information In the case that an individual requests under paragraph (a)(1)(i)(A) of section 164.522 of title 45, Code of Federal Regulations, that a covered entity restrict the disclosure of the protected health information of the individual, notwith- standing paragraph (a)(1)(ii) of such section, the covered entity must comply with the requested restriction if— (1) except as otherwise required by law, the disclosure is to a health plan for purposes of carrying out payment or health care oper- ations (and is not for purposes of carrying out treatment); and (2) the protected health information pertains solely to a health care item or service for which the health care provider involved has been paid out of pocket in full. (b) Disclosures required to be limited to the lim- ited data set or the minimum necessary (1) In general (A) In general Subject to subparagraph (B), a covered en- tity shall be treated as being in compliance with section 164.502(b)(1) of title 45, Code of Federal Regulations, with respect to the use, disclosure, or request of protected health in- formation described in such section, only if the covered entity limits such protected health information, to the extent prac- ticable, to the limited data set (as defined in section 164.514(e)(2) of such title) or, if need- ed by such entity, to the minimum nec- essary to accomplish the intended purpose of such use, disclosure, or request, respec- tively. (B) Guidance Not later than 18 months after February 17, 2009, the Secretary shall issue guidance on what constitutes ‘‘minimum necessary’’