42 U.S.C. § 17953 — Studies, reports, guidance
submitted 17 years ago by Pub. L. 111-5 to r/title-42-THE-PUBLIC-HEALTH-AND-WELFARE · 1,046 words · no verdicts yet
This section requires reports about complaints and compliance, a study of privacy and security requirements for certain entities outside HIPAA, and several other reports and studies. It also requires guidance on de-identifying protected health information and permits regulations about the definition of “psychotherapy notes”; this section does not define that term.
(a) Report on compliance
(1) In general
For the first year beginning after February 17, 2009, and every year after that, the Secretary* must prepare and submit a report to the Senate Committee on Health, Education, Labor, and Pensions, the House Committee on Ways and Means, and the House Committee on Energy and Commerce. The report must concern complaints of alleged violations of law, including this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as those provisions were in effect on February 17, 2009, concerning the privacy and security* of health information that the Secretary received during the year covered by the report. Each report must state*, for complaints received during that year: (A) the number of complaints; (B) the number resolved informally, a summary of the kinds of complaints resolved that way, and the number of covered entities that received technical help from the Secretary to comply during that year, along with the kinds of help provided; (C) the number that led to civil monetary penalties or monetary settlements, the nature of the complaints, and the amount paid for each penalty or settlement; (D) the number of compliance reviews and the result of each; (E) the number of subpoenas or inquiries issued; (F) the Secretary’s plan for improving compliance with and enforcement of these provisions during the next year; and (G) the number of audits performed and a summary of the audit findings under section 17940 of this title.
(2) Availability to public
Each report under paragraph (1) must be made available to the public on the Department of Health and Human Services’ Internet website.
(b) Study and report on application of privacy and security requirements to non-HIPAA covered entities
(1) Study
No later than one year after February 17, 2009, the Secretary, consulting with the Federal Trade Commission, must conduct a study and submit a report under paragraph (2) about privacy and security requirements for entities that were not covered entities or business associates as of February 17, 2009. The study must include: (A) requirements about security, privacy, and notification when security or privacy is breached, including whether notification should have an exception for individually identifiable health information made unusable, unreadable, or indecipherable through technologies or methods recognized by appropriate professional organizations or standard-setting bodies as providing effective security, that should apply to: (i) vendors of personal health records; (ii) entities that offer products or services through a personal-health-record vendor’s website; (iii) entities that are not covered entities and offer products or services through the websites of covered entities that offer individuals personal health records; (iv) entities that are not covered entities and access information in a personal health record* or send information to one; and (v) third-party service providers used by a vendor or an entity described in clause (i), (ii), (iii), or (iv) to help provide personal-health-record products or services; (B) which federal agency is best equipped to enforce the recommended requirements for those vendors, entities, and service providers; and (C) a timetable for implementing regulations based on the findings.
(2) Report
The Secretary must submit a report on the study’s findings to the Senate Committee on Finance, the Senate Committee on Health, Education, Labor, and Pensions, the Senate Committee on Commerce, the House Committee on Ways and Means, and the House Committee on Energy and Commerce. The report must include recommendations about the privacy and security requirements described in paragraph (1).
(c) Guidance on implementation specification to de-identify protected health information*
No later than 12 months after February 17, 2009, the Secretary, consulting with stakeholders, must issue guidance on how best to carry out the requirements for de-identifying protected health information under section 164.514(b) of title 45, Code of Federal Regulations.
(d) GAO report on treatment* disclosures
No later than one year after February 17, 2009, the Comptroller General of the United States must submit a report to the Senate Committee on Health, Education, Labor, and Pensions, the House Committee on Ways and Means, and the House Committee on Energy and Commerce about best practices* for health care providers to disclose* an individual’s protected health information to one another for treating that individual. The report must examine best practices used by States and other entities, such as health information exchanges and regional health information organizations; how successful those practices are in the quality of the resulting health care and in the provider’s ability to manage them; and the use* of electronic informed consent to disclose protected health information for treatment, payment*, and health care operations.
(e) Report required
No later than 5 years after February 17, 2009, the Government Accountability Office must submit to Congress and the Secretary of Health and Human Services a report on the effect of any provision of this Act on health insurance premiums, overall health care costs, providers’ adoption of electronic health records, and reductions in medical errors and other improvements in quality.
(f) Study
The Secretary must study the definition of “psychotherapy notes” in section 164.501 of title 45, Code of Federal Regulations, regarding whether that definition should include test data related to direct responses, scores, items, forms, protocols, manuals, or other materials that are part of a mental health evaluation, as determined by the mental health professional providing the treatment or evaluation. Based on the study, the Secretary may issue regulations revising that definition.
For the first year beginning after February 17, 2009, and annually thereafter, the Secretary* shall prepare and submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives a report concerning complaints of alleged violations of law, including the provisions of this subchapter as well as the provisions of subparts C and E of part 164 of title 45, Code of Federal Regulations, (as such provisions are in effect as of February 17, 2009) relating to privacy and security* of health information that are received by the Secretary during the year for which the report is being prepared. Each such report shall include, with respect to such complaints received during the year—
the number of such complaints;
the number of such complaints resolved informally, a summary of the types of such complaints so resolved, and the number of covered entities that received technical assistance from the Secretary during such year in order to achieve compliance with such provisions and the types of such technical assistance provided;
the number of such complaints that have resulted in the imposition of civil monetary penalties or have been resolved through monetary settlements, including the nature of the complaints involved and the amount paid in each penalty or settlement;
the number of compliance reviews conducted and the outcome of each such review;
the number of subpoenas or inquiries issued;
the Secretary’s plan for improving compliance with and enforcement of such provisions for the following year; and
the number of audits performed and a summary of audit findings pursuant to section 17940 of this title.
Each report under paragraph (1) shall be made available to the public on the Internet website of the Department of Health and Human Services.
Not later than one year after February 17, 2009, the Secretary, in consultation with the Federal Trade Commission, shall conduct a study, and submit a report under paragraph (2), on privacy and security requirements for entities that are not covered entities or business associates as of February 17, 2009, including—
requirements relating to security, privacy, and notification in the case of a breach* of security or privacy (including the applicability of an exemption to notification in the case of individually identifiable health information that has been rendered unusable, unreadable, or indecipherable through technologies or methodologies recognized by appropriate professional organization or standard setting bodies to provide effective security for the information) that should be applied to—
vendors of personal health records;
entities that offer products or services through the website of a vendor of personal health records*;
entities that are not covered entities and that offer products or services through the websites of covered entities that offer individuals personal health records;
entities that are not covered entities and that access information in a personal health record* or send information to a personal health record; and
third party service providers used by a vendor or entity described in clause (i), (ii), (iii), or (iv) to assist in providing personal health record products or services;
a determination of which Federal government agency is best equipped to enforce such requirements recommended to be applied to such vendors, entities, and service providers under subparagraph (A); and
a timeframe for implementing regulations based on such findings.
The Secretary shall submit to the Committee on Finance, the Committee on Health, Education, Labor, and Pensions, and the Committee on Commerce of the Senate and the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives a report on the findings of the study under paragraph (1) and shall include in such report recommendations on the privacy and security requirements described in such paragraph.
Not later than 12 months after February 17, 2009, the Secretary shall, in consultation with stakeholders, issue guidance on how best to implement the requirements for the de-identification of protected health information under section 164.514(b) of title 45, Code of Federal Regulations.
Not later than one year after February 17, 2009, the Comptroller General of the United States shall submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives a report on the best practices* related to the disclosure* among health care providers of protected health information of an individual for purposes of treatment of such individual. Such report shall include an examination of the best practices implemented by States and by other entities, such as health information exchanges and regional health information organizations, an examination of the extent to which such best practices are successful with respect to the quality of the resulting health care provided to the individual and with respect to the ability of the health care provider* to manage such best practices, and an examination of the use* of electronic informed consent for disclosing protected health information for treatment, payment*, and health care operations.
Not later than 5 years after February 17, 2009, the Government Accountability Office shall submit to Congress and the Secretary of Health and Human Services a report on the impact of any of the provisions of this Act on health insurance premiums, overall health care costs, adoption of electronic health records by providers, and reduction in medical errors and other quality improvements.
The Secretary shall study the definition of “psychotherapy notes” in section 164.501 of title 45, Code of Federal Regulations, with regard to including test data that is related to direct responses, scores, items, forms, protocols, manuals, or other materials that are part of a mental health evaluation, as determined by the mental health professional providing treatment or evaluation in such definitions and may, based on such study, issue regulations to revise such definition.
Source credit: (Pub. L. 111–5, div. A, title XIII, § 13424, Feb. 17, 2009, 123 Stat. 276.)
- 2009Enacted · Pub. L. 111-5 · 123 Stat. 276
A history note hasn’t been published yet. The record shows enactment by Pub. L. 111-5 on 2009-02-17.
all 0 arguments · sorted by: best
no arguments yet — make the first case