42 U.S.C. § 17953 — Studies, reports, guidance

(a) Report on compliance (1) Starting with the first full year after February 17, 2009, and every year after that, the Secretary must send a report to the Senate Committee on Health, Education, Labor, and Pensions, and to the House Committees on Ways and Means and on Energy and Commerce. The report covers complaints received that year about possible violations of this subchapter and of the related federal privacy and security rules (45 C.F.R. part 164, subparts C and E, as they stood on February 17, 2009). Each report must include: (A) how many complaints came in; (B) how many were resolved informally, what kinds those were, and how many covered entities got technical help from the Secretary to fix problems, and what kind of help; (C) how many complaints led to civil penalties or paid settlements, what those complaints were about, and how much was paid in each case; (D) how many compliance reviews were done and what each one found; (E) how many subpoenas or inquiries were issued; (F) the Secretary's plan for improving compliance and enforcement the following year; and (G) how many audits were done under section 17940, and a summary of what they found. (2) The Secretary must post each year's report on HHS's website for the public to see. (b) Study and report on applying privacy and security rules to companies not covered by HIPAA (1) Within a year of February 17, 2009, the Secretary — working with the Federal Trade Commission — had to study what privacy, security, and breach-notification rules should apply to companies that are not HIPAA covered entities or business associates. This includes: personal health record vendors; companies that offer products or services through a PHR vendor's website; non-covered companies that offer products or services through a covered entity's website that offers personal health records; non-covered companies that access or send information to a personal health record; and third-party service providers that work for any of those companies. The study also had to look at whether an exemption from notification should apply when health information has been made unusable, unreadable, or undecipherable using recognized security methods, and had to figure out which federal agency is best suited to enforce these new rules, plus a timeframe for writing the regulations. (2) The Secretary had to send the results — including recommendations — to the Senate Finance, HELP, and Commerce Committees, and to the House Ways and Means and Energy and Commerce Committees. (c) Guidance on de-identifying health information Within 12 months of February 17, 2009, the Secretary — after consulting with stakeholders — had to issue guidance on the best way to meet the de-identification requirements in 45 C.F.R. § 164.514(b). (d) GAO report on sharing records for treatment Within a year of February 17, 2009, the Comptroller General had to report to the Senate HELP Committee and the House Ways and Means and Energy and Commerce Committees on best practices for health care providers sharing a patient's protected health information with each other for treatment purposes. The report had to look at practices used by states and by groups like health information exchanges, how well those practices actually improved care and how manageable they were for providers, and how electronic informed consent is being used when sharing records for treatment, payment, and health care operations. (e) Report on the law's overall impact Within 5 years of February 17, 2009, the Government Accountability Office had to report to Congress and the Secretary on how the Act's provisions affected health insurance premiums, overall health care costs, how many providers adopted electronic health records, and whether medical errors dropped and quality improved. (f) Study on the definition of "psychotherapy notes" The Secretary had to study the definition of "psychotherapy notes" in 45 C.F.R. § 164.501 — specifically, whether it should include test data such as direct responses, scores, items, forms, protocols, manuals, or other materials that are part of a mental health evaluation, as the treating or evaluating mental health professional decides. Based on that study, the Secretary may issue regulations revising the definition.