42 U.S.C. § 300jj–11 — Office of the National Coordinator for Health Information Technology

(a) Establishment The Department of Health and Human Services now has an Office of the National Coordinator for Health Information Technology (called "the Office" in this section). A National Coordinator, appointed by the Secretary, heads the Office and reports directly to the Secretary. (b) Purpose The National Coordinator must carry out the duties in subsection (c) in a way consistent with developing a nationwide health information technology infrastructure for electronically using and exchanging information, one that: (1) keeps each patient's health information secure and protected under applicable law; (2) improves health care quality, reduces medical errors, reduces health disparities, and advances patient-centered medical care; (3) reduces health care costs caused by inefficiency, medical errors, inappropriate care, duplicate care, and incomplete information; (4) provides useful information to guide medical decisions at the time and place of care; (5) makes sure the public has meaningful input into building the infrastructure; (6) improves coordination of care and information among hospitals, laboratories, physician offices, and other entities through an effective, secure, authorized exchange infrastructure; (7) improves public health work and speeds up identifying and responding to public health threats and emergencies, including bioterror events and infectious disease outbreaks; (8) supports health and clinical research and health care quality; (9) promotes early detection, prevention, and management of chronic disease; (10) promotes a more effective marketplace, more competition, more systems analysis, more consumer choice, and better health care outcomes; and (11) improves efforts to reduce health disparities. (c) Duties of the National Coordinator (1) Standards. The Coordinator must review and decide whether to endorse each standard, implementation specification, and certification criterion the HIT Advisory Committee recommends under section 300jj-12 for adoption under section 300jj-14, and must report each such determination to the Secretary within 45 days after receiving the recommendation. The Coordinator must also review federal health IT investments to make sure federal health IT programs are meeting the objectives of the strategic plan described in paragraph (3). (2) HIT policy coordination. The Coordinator must coordinate the Department's health IT policy and programs with those of other relevant executive branch agencies, aiming to avoid duplicated effort and to help each agency work mainly within its area of greatest expertise, moving toward a coordinated national goal. The Coordinator must also take a leading role in establishing and running the HIT Advisory Committee and serve as the liaison between that Committee and the federal government. (3) Strategic plan. Working with other appropriate federal agencies (including the National Institute of Standards and Technology), the Coordinator must update the Federal Health IT Strategic Plan to include specific objectives, milestones, and metrics for: the electronic exchange and use of health information and enterprise integration of that information; getting an electronic health record used for every person in the United States by 2014; building in privacy and security protections for electronically exchanging an individual's individually identifiable health information; ensuring security methods for appropriate authorization and electronic authentication of health information, and specifying technologies or methods to render health information unusable, unreadable, or indecipherable to unauthorized people; specifying a framework for how recommendations and policies flow among the Secretary, the National Coordinator, the HIT Advisory Committee, and other health information exchanges and relevant entities; methods to help the public understand health information technology; strategies to improve health care quality, reduce medical errors, reduce health disparities, improve public health, increase prevention and coordination with community resources, and improve continuity of care through health IT; and specific plans making sure populations with unique needs, such as children, are addressed in the technology's design, which may include technology that automates enrollment and retention for eligible individuals. The strategic plan must be updated through collaboration between public and private entities, must include measurable outcome goals, and the Coordinator must republish the plan, including all updates. (4) Website. The Coordinator must maintain and frequently update a website posting information on the Office's work, schedules, reports, and recommendations, to keep the effort transparent. (5) Certification. The Coordinator, working with the Director of the National Institute of Standards and Technology, must keep or recognize a program (or programs) for voluntarily certifying health IT as complying with adopted certification criteria, including, as appropriate, testing the technology under section 17911(b). "Certification criteria" means the criteria used to establish that technology meets the adopted standards and implementation specifications. The Coordinator must also encourage, keep, or recognize voluntary certification of health IT for medical specialties and care settings that currently lack such technology or need more technological advancement or integration; the Secretary must accept public comment on which additional specialties and settings need this; and, on set deadlines after December 13, 2016, the Secretary must make recommendations for, and then adopt, certification criteria to support voluntary certification of health IT for pediatric health providers. Not later than one year after December 13, 2016, the Secretary, through notice-and-comment rulemaking, must require - as a condition of certification and of keeping certification - that a health IT developer or entity: (i) not take any action that is "information blocking" as defined in section 300jj-52(a); (ii) give the Secretary satisfactory assurances that, unless for legitimate purposes the Secretary specifies, it will not block information or take other action that could inhibit the appropriate exchange, access, and use of electronic health information; (iii) not prohibit or restrict communication about the technology's usability, interoperability, or security; about users' experiences using it; about developers' business practices around exchanging electronic health information; or about how a user has used the technology; (iv) have published application programming interfaces (APIs) and let health information from the technology be accessed, exchanged, and used without special effort through those APIs (or successor technology or standards), including access to all data elements of a patient's electronic health record to the extent privacy law allows; (v) have successfully tested the technology's real-world interoperability (as defined in section 300jj) in the type of setting where it will be marketed; and (vi) give the Secretary an attestation confirming it has not engaged in information blocking, has given the required assurances, does not restrict the listed communications, has published the required information, ensures the technology allows information exchange as described, and has undertaken the required real-world testing - plus (vii) submit reporting criteria under section 300jj-19a(b). The Secretary may encourage compliance with these conditions and take action, as appropriate, to discourage noncompliance. (6) Reports and publications. Not later than 12 months after February 17, 2009, the Coordinator must report to the relevant House and Senate committees on any additional funding or authority the Coordinator, the HIT Policy Committee, or the HIT Standards Committee needs to evaluate and develop standards, implementation specifications, and certification criteria, or to get full stakeholder participation in adopting a nationwide health IT infrastructure. The Coordinator must also prepare a report identifying lessons learned from major public and private health care systems' implementation of health IT, including whether those lessons apply to and could be used by other providers; must assess and publish the impact of health IT in communities with health disparities and in areas with many uninsured, underinsured, and medically underserved individuals (urban and rural), and identify practices to increase adoption there and to better manage chronic disease; must evaluate and publish evidence on the benefits and costs of electronically using and exchanging health information, and assess who bears those costs and benefits; and must estimate and publish, annually, the resources needed to reach the goal of an electronic health record for every person in the U.S. by 2014, including the needed level of federal funding, expectations for regional, state, and private investment, expected volunteer contributions, and the resources needed to build a sufficient health IT workforce (including education programs in medical informatics and health information management). (7) Assistance. The Coordinator may give financial assistance to consumer advocacy groups and not-for-profit entities that work in the public interest, to help cover their costs of participating in activities connected to the National Technology Transfer Act of 1995. (8) Governance for nationwide health information network. The Coordinator must set up a governance mechanism for the nationwide health information network. (9) Support for interoperable networks exchange. Working with the National Institute of Standards and Technology and other relevant HHS agencies, and to ensure full network-to-network exchange of health information, the Coordinator must convene public-private and public-public partnerships, at whatever frequency the Secretary decides is appropriate, to build consensus and develop or support a "trusted exchange framework," including a common agreement among health information networks nationally. Not later than 6 months after December 13, 2016, the Coordinator had to convene appropriate public and private stakeholders to develop or support this framework and common agreement for trust policies and practices, which may include a common method of authenticating trusted participants, a common set of rules for trusted exchange, organizational and operational policies enabling exchange (including minimum conditions for it to occur), and a process for filing and deciding noncompliance with the common agreement's terms. The Coordinator, with the National Institute of Standards and Technology, must give technical assistance on implementing the framework and common agreement, and must provide for pilot testing of it (which may be delegated to independent entities with appropriate expertise). Not later than 1 year after convening stakeholders, the Coordinator must publish the finished trusted exchange framework and common agreement on its website and in the Federal Register, in a manner that protects proprietary and security information, including trade secrets and other protected intellectual property. Not later than 2 years after convening stakeholders, and annually after that, the Coordinator must publish on its website a list of health information networks that have adopted the common agreement and are capable of trusted exchange under it; the Secretary must, through notice-and-comment rulemaking, set up a process for networks that voluntarily elect to adopt the framework and agreement to attest to that adoption. As appropriate, federal agencies contracting or agreeing with health information exchange networks may require that, as a network upgrades its technology or trust and operational practices, it adopt the published trusted exchange framework and common agreement, where available. Nothing in this paragraph requires any health information network to adopt the framework or agreement generally, nor to adopt it for exchanging information between participants of the same network - except that federal agencies may still require adoption for networks contracting or agreeing with them. The published framework and agreement must take into account existing trusted exchange frameworks and agreements already used, to avoid disrupting existing exchanges between network participants, and the Secretary must make sure ongoing work by public and private organizations on exchange between health information exchanges is considered, to avoid duplicating effort. (d) Detail of Federal employees (1) At the National Coordinator's request, the head of any federal agency may detail any of that agency's personnel to the Office to help carry out its duties, with or without reimbursement from the Office. (2) Detailing personnel this way does not interrupt or affect the employee's civil service status or privileges, and is in addition to any other Department staff employed by the National Coordinator. (3) Regardless of any other law, the Office may accept detailed personnel from other federal agencies whether or not that agency is reimbursed. (e) Chief Privacy Officer of the Office of the National Coordinator Not later than 12 months after February 17, 2009, the Secretary must appoint a Chief Privacy Officer for the Office of the National Coordinator. That officer's duty is to advise the National Coordinator on privacy, security, and data stewardship of electronic health information, and to coordinate with other federal agencies (and similar privacy officers at those agencies), with state and regional efforts, and with foreign countries on the privacy, security, and data stewardship of electronic individually identifiable health information.