text:
Page:United States Statutes at Large Volume 123.djvu/273

 123STA T . 2 5 3 PUBLIC LA W 111 – 5 —FE B.1 7, 2 0 0 9‘ ‘ SEC.3014 . C OMP E TI TI V E GRAN TS TO STATES AN D INDIAN TRI B ES F ORT H E DEVE L OPMENT OF LOAN PROGRAMS TO FACILI - TATE THE W IDESPREAD ADOPTION OF CERTIFIED EHR TECHNOLOG Y . ‘ ‘ (a)INGE NE RAL.—TheN a tion a lC oo rd inator m a y a w ard c om p etiti v e g rant s to eligi b le entities f or the establishment of pro - grams for loans to health care providers to cond u ct the activities described in subsection (e). ‘‘(b) E L IG I B LE EN T IT YD E F INE D .— F or purposes of this sub- section , the term ‘eligible entity ’ means a S tate or Indian tribe (as defined in the Indian Self-Determination and Education A ssist- ance Act) that— ‘‘( 1 ) submits to the National Coordinator an application at such time, in such manner, and containing such information as the National Coordinator may re q uire ‘‘( 2 ) submits to the National Coordinator a strategic plan in accordance with subsection (d) and provides to the National Coordinator assurances that the entity will update such plan annually in accordance with such subsection; ‘‘( 3 ) provides assurances to the National Coordinator that the entity will establish a L oan Fund in accordance with sub- section (c); ‘‘( 4 ) provides assurances to the National Coordinator that the entity will not provide a loan from the Loan Fund to a health care provider unless the provider agrees to— ‘‘(A) submit reports on quality measures adopted by the Federal Government (by not later than 90 days after the date on which such measures are adopted), to— ‘‘(i) the Administrator of the Centers for M edicare & Medicaid Services (or his or her designee), in the case of an entity participating in the Medicare program under title XV III of the Social Security Act or the Medicaid program under title XIX of such Act; or ‘‘(ii) the Secretary in the case of other entities; ‘‘( B ) demonstrate to the satisfaction of the Secretary (through criteria established by the Secretary) that any certified E HR technology purchased, improved, or otherwise financially supported under a loan under this section is used to e x change health information in a manner that, in accordance with law and standards (as adopted under section 3004) applicable to the exchange of information, improves the quality of health care, such as promoting care coordination; and ‘‘(C) comply with such other requirements as the entity or the Secretary may require; ‘‘(D) include a plan on how health care providers involved intend to maintain and support the certified EHR technology over time; ‘‘(E) include a plan on how the health care providers involved intend to maintain and support the certified EHR technology that would be purchased with such loan, including the type of resources expected to be involved and any such other information as the State or Indian Tribe, respectively, may require; and ‘‘( 5 ) agrees to provide matching funds in accordance with subsection (h). Reports.D e adlin e. 42USC30 0 j j – 34.


text:
Page:United States Statutes at Large Volume 123.djvu/274

 123STA T . 2 54PUBLIC LA W 111 – 5 —FE B.1 7, 2 0 0 9‘ ‘ (c)ESTABLI S HMEN T OFFU N D.— F orpu rpo se so f su b sec ti o n (b)( 3 ) ,a ne l i g ible entit y s h all establish a certifie d E HR technology loan fund (referred to in this subsection as a ‘ L oan Fund ’ ) and co m ply w ith the other re q uirements contained in this section. A grant to an eligible entity under this section shall be deposited in the Loan Fund established by the eligible entity. N o funds authori z ed by other pro v isions of this title to be used for other purposes specified in this title shall be deposited in any Loan Fund. ‘‘(d) S T R ATE G I CP LAN.— ‘‘( 1 ) I N GENERAL.—For purposes of subsection (b)( 2 ), a stra - tegic plan of an eligible entity under this subsection shall identify the intended uses of amounts available to the Loan Fund of such entity. ‘‘(2) C ONTENTS.—A strategic plan under paragraph (1), with respect to a Loan Fund of an eligible entity, shall include for a year the following ‘‘(A) A list of the pro j ects to be assisted through the Loan Fund during such year. ‘‘( B ) A description of the criteria and methods estab- lished for the distribution of funds from the Loan Fund during the year. ‘‘(C) A description of the financial status of the Loan Fund as of the date of submission of the plan. ‘‘( D ) T he short-term and long-term goals of the Loan Fund. ‘‘(e) U SE OF FUNDS.—Amounts deposited in a Loan Fund, including loan repayments and interest earned on such amounts, shall be used only for awarding loans or loan guarantees, ma k ing reimbursements described in subsection (g)( 4 )(A), or as a source of reserve and security for leveraged loans, the proceeds of which are deposited in the Loan Fund established under subsection (c). Loans under this section may be used by a health care provider to— ‘‘(1) facilitate the purchase of certified EHR technology ‘‘(2) enhance the utilization of certified EHR technology (which may include costs associated with upgrading health information technology so that it meets criteria necessary to be a certified EHR technology); ‘‘(3) train personnel in the use of such technology; or ‘‘(4) improve the secure electronic e x change of health information. ‘‘(f) T YP ES OF ASSISTANCE.—Except as otherwise limited by applicable State law, amounts deposited into a Loan Fund under this section may only be used for the following: ‘‘(1) To award loans that comply with the following: ‘‘(A) The interest rate for each loan shall not exceed the market interest rate. ‘‘(B) The principal and interest payments on each loan shall commence not later than 1 year after the date the loan was awarded, and each loan shall be fully amortized not later than 1 0 years after the date of the loan. ‘‘(C) The Loan Fund shall be credited with all payments of principal and interest on each loan awarded from the Loan Fund. ‘‘(2) To guarantee, or purchase insurance for, a local obliga- tion (all of the proceeds of which finance a project eligible

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/


text:
Page:United States Statutes at Large Volume 123.djvu/275

 123STA T . 2 5 5 PUBLIC LA W 111 – 5 —FE B.1 7, 2 0 0 9foras s i s t a nceu n d ert h is su b section ) if the g uarantee or p ur - chase w ou l di m pro v e credit mar k et access or reduce the interest rate applicable to the obligation involved .‘ ‘ (3 ) A s a source of revenue or securit y for the payment of principal and interest on revenue or general obligation bonds issued by the eligible entity if the proceeds of the sale of the bonds will be deposited into the L oan F und. ‘‘( 4 ) T o earn interest on the amounts deposited into the Loan Fund. ‘‘( 5 ) To make reimbursements described in subsection (g)(4)(A). ‘‘(g) A DMIN I STRA TI O NO F LOAN F U NDS. — ‘‘( 1 ) C OM B IN E D FINAN C IA L ADMINISTRATION.—An eligible entity may (as a convenience and to avoid unnecessary adminis- trative costs) combine, in accordance with applicable S tate law, the financial administration of a Loan Fund established under this subsection with the financial administration of any other revolving fund established by the entity if otherwise not prohib- ited by the law under which the Loan Fund was established. ‘‘( 2 ) COST OF ADMINISTERIN G FUND.— E ach eligible entity may annually use not to e x ceed 4 percent of the funds provided to the entity under a grant under this section to pay the reasonable costs of the administration of the programs under this section, including the recovery of reasonable costs expended to establish a Loan Fund which are incurred after the date of the enactment of this title. ‘‘(3) G UIDANCE AND REGULATIONS.—The N ational Coordi- nator shall publish guidance and promulgate regulations as may be necessary to carry out the provisions of this section, including— ‘‘(A) provisions to ensure that each eligible entity com- mits and expends funds allotted to the entity under this section as efficiently as possible in accordance with this title and applicable State laws and ‘‘( B ) guidance to prevent waste, fraud, and abuse. ‘‘(4) P RI V ATE SECTOR CONTRIBUTIONS.— ‘‘(A) I N GENERAL.—A Loan Fund established under this section may accept contributions from private sector enti- ties, except that such entities may not specify the recipient or recipients of any loan issued under this subsection. An eligible entity may agree to reimburse a private sector entity for any contribution made under this subparagraph, except that the amount of such reimbursement may not be greater than the principal amount of the contribution made. ‘‘(B) AVAILABILIT Y OF INFORMATION.—An eligible entity shall make publicly available the identity of, and amount contributed by, any private sector entity under subpara- graph (A) and may issue letters of commendation or make other awards (that have no financial value) to any such entity. ‘‘(h) M ATC H ING R E Q UIREMENTS.— ‘‘(1) IN GENERAL.—The National Coordinator may not make a grant under subsection (a) to an eligible entity unless the entity agrees to make available (directly or through donations from public or private entities) non-Federal contributions in cash to the costs of carrying out the activities for which the Publicat i on.


text:
Page:United States Statutes at Large Volume 123.djvu/276

 123STA T . 2 56PUBLIC LA W 111 – 5 —FE B.1 7, 2 0 0 9grantis a w ar de dinana mou nte q ua l to not less t h an $1f or ea c h$ 5 of F ederal funds p ro v ided under the grant .‘ ‘ (2)DET E RMINA TI O NO F AMO U NT OF NON - FE D ERA LC ON- TRI B UTION. —I n determining the amount of non-Federal con- tri b utions that an eligible entit y has provided pursuant to subparagraph ( A ) , the N ational C oordinator may not include any amounts provided to the entity by the Federal G overnment. ‘‘(i) E FFECTI V E DATE.— T he S ecretary may not ma k e an award under this section prior to J anuary 1, 2 0 10. ‘ ‘ SEC.3015 . D E MON S TRA T I ON P RO G RAM TO INTEGRATE IN F ORMATION TEC H NO L OG Y INTO CLINICAL ED U CATION. ‘‘(a) IN GENERAL.—The Secretary may award grants under this section to carry out demonstration pro j ects to develop academic curricula integrating certified E HR technology in the clinical edu- cation of health professionals. Such awards shall be made on a competitive basis and pursuant to peer review. ‘‘(b) ELI G IBILIT Y .—To be eligible to receive a grant under sub- section (a), an entity shall— ‘‘(1) submit to the Secretary an application at such time, in such manner, and containing such information as the Sec- retary may require ‘‘(2) submit to the Secretary a strategic plan for integrating certified EHR technology in the clinical education of health professionals to reduce medical errors, increase access to prevention, reduce chronic diseases, and enhance health care quality; ‘‘( 3 ) be— ‘‘(A) a school of medicine, osteopathic medicine, den- tistry, or pharmacy, a graduate program in behavioral or mental health, or any other graduate health professions school; ‘‘( B ) a graduate school of nursing or physician assistant studies; ‘‘(C) a consortium of two or more schools described in subparagraph (A) or (B); or ‘‘(D) an institution with a graduate medical education program in medicine, osteopathic medicine, dentistry, phar- macy, nursing, or physician assistance studies; ‘‘( 4 ) provide for the collection of data regarding the effective- ness of the demonstration project to be funded under the grant in improving the safety of patients, the efficiency of health care delivery, and in increasing the likelihood that graduates of the grantee will adopt and incorporate certified EHR tech- nology, in the delivery of health care services; and ‘‘(5) provide matching funds in accordance with subsection (d). ‘‘(c) US E OF FUNDS.— ‘‘(1) IN GENERAL.— W ith respect to a grant under subsection (a), an eligible entity shall— ‘‘(A) use grant funds in collaboration with 2 or more disciplines; and ‘‘(B) use grant funds to integrate certified EHR tech- nology into community-based clinical education. ‘‘(2) L IMITATION.—An eligible entity shall not use amounts received under a grant under subsection (a) to purchase hard- ware, software, or services. Stra t egicpl a n.42U S C30 0 j j – 3 5.


text:
Page:United States Statutes at Large Volume 123.djvu/277

 123STA T . 2 57PUBLIC LA W 111 – 5 —FE B. 17 , 2 0 0 9‘ ‘ (d)FINA N C IA LSUP P ORT.—The Se cr e ta r ym ay no t p ro vi de more than 50 percent o f the co s ts of any activity for w hich assistance is provided u nder su b section (a) , e x cept in an instance of nationa l economic conditions which would render the cost - share re q uirement under this subsection detrimental to the pro g ram and upon notifica- tion to C ongress as to the j ustification to waive the cost-share requirement. ‘‘(e) EV ALUATION.—The Secretary shall ta k e such action as may be necessary to evaluate the projects funded under this section and publish, make available, and disseminate the results of such evaluations on as wide a basis as is practicable. ‘‘(f) RE PORT S .— N ot later than 1 year after the date of enactment of this title, and annually thereafter, the Secretary shall submit to the Committee on H ealth, Education, L abor, and P ensions and the Committee on Finance of the Senate, and the Committee on Energy and Commerce of the House of Representatives a report that— ‘‘(1) describes the specific projects established under this section and ‘‘( 2 ) contains recommendations for Congress based on the evaluation conducted under subsection (e). ‘ ‘ SEC.3016 . INFORMAT ION TEC H NO L O GYP ROFESSIONALS IN HEALTH CARE. ‘‘(a) I N G ENERAL.—The Secretary, in consultation with the D irector of the National Science Foundation, shall provide assist- ance to institutions of higher education (or consortia thereof) to establish or expand medical health informatics education programs, including certification, undergraduate, and masters degree pro- grams, for both health care and information technology students to ensure the rapid and effective utili z ation and development of health information technologies (in the U nited States health care infrastructure). ‘‘(b) A CTIVITIES.—Activities for which assistance may be pro- vided under subsection (a) may include the following ‘‘(1) Developing and revising curricula in medical health informatics and related disciplines. ‘‘(2) Recruiting and retaining students to the program involved. ‘‘( 3 ) Acquiring equipment necessary for student instruction in these programs, including the installation of testbed net- works for student use. ‘‘( 4 ) Establishing or enhancing bridge programs in the health informatics fields between community colleges and universities. ‘‘(c) PRIORIT Y .—In providing assistance under subsection (a), the Secretary shall give preference to the following: ‘‘(1) Existing education and training programs. ‘‘(2) Programs designed to be completed in less than six months. ‘‘SEC. 301 7 . GENERAL GRANT AN D LOAN PRO V ISIONS. ‘‘(a) REPORTS.—The Secretary may require that an entity receiving assistance under this subtitle shall submit to the Sec- retary, not later than the date that is 1 year after the date of receipt of such assistance, a report that includes— 42USC30 0 j j – 3 7. 42 USC 300jj–3 6 . Publicat i on .


text:
Page:United States Statutes at Large Volume 123.djvu/278

 123STA T . 2 58PUBLIC LA W 111 – 5 —FE B.1 7, 2 0 0 9‘ ‘ (1)an ana lysi s ofthe effe c ti v eness of the activities fo rw hich the entity receives s u ch assistance , as co mp are d to the g oals for such activities and ‘‘( 2 ) an analysis of the impact of the pro j ect on health care q uality and safety . ‘‘( b ) REQUIR E M E NT T OI M P RO V E Q U AL IT Y O FC ARE AN DD E C REA S E IN COSTS. —T he N ational Coordinator shall annually evaluate the activities conducted under this subtitle and shall, in awarding grants, implement the lessons learned from such evaluation in a manner so that awards made subsequent to each such evaluation are made in a manner that, in the determination of the National Coordinator, will result in the greatest improvement in the quality and efficiency of health care. ‘ ‘ SEC.3018 . AUTHORIZ ATIO NF ORA P PROPRIATIONS. ‘‘ F or the purposes of carrying out this subtitle, there is author - i z ed to be appropriated such sums as may be necessary for each of the fiscal years 2 0 0 9 through 201 3 . ’ ’. Subti t leD—Pr i vacy SEC. 13 4 00. D EFINITIONS. In this subtitle, e x cept as specified otherwise (1) B REAC H .— ( A )IN G ENERAL.—The term ‘‘breach’’ means the unauthorized acquisition, access, use, or disclosure of pro- tected health information which compromises the security or privacy of such information, except where an unauthor- ized person to whom such information is disclosed would not reasonably have been able to retain such information. (B) EX CEPTIONS.—The term ‘‘breach’’ does not include— (i) any unintentional acquisition, access, or use of protected health information by an employee or indi- vidual acting under the authority of a covered entity or business associate if— (I) such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relation- ship of such employee or individual, respectively, with the covered entity or business associate; and (II) such information is not further acquired, accessed, used, or disclosed by any person; or (ii) any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated indi- vidual at same facility; and (iii) any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person. (2) BUSINESS ASSOCIATE.—The term ‘‘business associate’’ has the meaning given such term in section 1 6 0.103 of title 45, Code of Federal Regulations. (3) COVERED ENTITY.—The term ‘‘covered entity’’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. 42USC179 21 . 42 USC 30 0 j j – 3 8 . Evalu a tion . De a d line.


text:
Page:The complete poems of Emily Bronte.djvu/344

288 XLV


text:
Page:United States Statutes at Large Volume 123.djvu/279

 123STA T . 2 59PUBLIC LA W 111 – 5 —FE B.1 7, 2 0 09 (4)DISCLO S E.—Thet e rms‘ ‘ di s clo se ’ ’ an d ‘‘disclos u re’’ ha v e the meanin g given the term ‘‘disclosure’’ in section 160 .10 3 o f title 4 5,C ode of F ederal R egulations. (5) E LEC TR O N IC H E A LTH RECOR D .—The term ‘‘electronic health record’’ means an electronic record of health - related information on an individual that is created, gathered, man- aged, and consulted by authori z ed health care clinicians and staff. (6) H EALTH CARE O P ERATIONS.—The term ‘‘health care o p er- ation’’ has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. ( 7 ) HEALTH CARE PRO V IDER.—The term ‘‘health care pro- vider’’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. ( 8 ) HEALTH PLAN.—The term ‘‘health plan’’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. ( 9 ) N ATIONAL COORDINATOR.—The term ‘‘National Coordi- nator’’ means the head of the O ffice of the National Coordinator for Health I nformation Technology established under section 3001(a) of the P ublic Health S ervice A ct, as added by section 13101. (10) PA YM ENT.—The term ‘‘payment’’ has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. (11) PERSONAL HEALTH RECORD.—The term ‘‘personal health record’’ means an electronic record of PHR identifiable health information (as defined in section 13407(f)( 2 ))onan individual that can be dra w n from multiple sources and that is managed, shared, and controlled by or primarily for the individual. (12) PROTECTED HEALTH IN F ORMATION.—The term ‘‘pro- tected health information’’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (13) SECRETARY.—The term ‘‘Secretary’’ means the Sec- retary of Health and Human Services. (14) SEC U RITY.—The term ‘‘security’’ has the meaning given such term in section 164.304 of title 45, Code of Federal Regula- tions. (15) STATE.—The term ‘‘State’’ means each of the several States, the District of Columbia, Puerto Rico, the V irgin Islands, G uam, American Samoa, and the Northern M ariana Islands. (16) TREATMENT.—The term ‘‘treatment’’ has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. (17) U SE.—The term ‘‘use’’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (18) VENDOR OF PERSONAL HEALTH RECORDS.—The term ‘‘vendor of personal health records’’ means an entity, other than a covered entity (as defined in paragraph (3)), that offers or maintains a personal health record.


text:
Page:United States Statutes at Large Volume 123.djvu/280

 123STA T . 2 60PUBLIC LA W 111 –5—FE B.1 7, 200 9PART1—IM PR OVED PRIVA CY PROVI S IO N S AND SEC U RITY PROVISIONS SEC.1340 1. AP P LI CA T I ON O F SEC UR IT Y PRO V ISIONS AN D PENALTIES TO B USINESS ASSOCIATES OF COVERED ENTITIES ANNUAL G UIDANCE ON SECURITY PROVISIONS. (a)AP P LICAT I ON O FSE C UR IT YP RO V I S IONS .— S ections164 . 308, 164.310, 164.31 2 ,an d 164.316 o f tit l e4 5, C ode of F ede r al R e gu la - tions, s h all a p pl y toa b usiness associate of a co v ered entity in the sa m e manner that such sections apply to the covered entity. T he additional re q uirements of this title that relate to security and that are made applicable w ith respect to covered entities shall also be applicable to such a business associate and shall be incor- porated into the business associate agreement between the business associate and the covered entity. (b) APPLICATION OF CIVIL AN D CRI M INAL PENALTIES.— I n the case of a business associate that violates any security provision specified in subsection (a), sections 11 7 6 and 1177 of the Social Security Act (42 U .S.C. 1320d – 5, 1320d–6) shall apply to the busi- ness associate with respect to such violation in the same manner such sections apply to a covered entity that violates such security provision. (c) ANNUAL G UIDANCE.—For the first year beginning after the date of the enactment of this Act and annually thereafter, the Secretary of H ealth and Human Services shall, after consultation with sta k eholders, annually issue guidance on the most effective and appropriate technical safeguards for use in carrying out the sections referred to in subsection (a) and the security standards in subpart C of part 164 of title 45, Code of Federal Regulations, including the use of standards developed under section 3002(b)(2)( B )(vi) of the Public Health Service Act, as added by section 13101 of this Act, as such provisions are in effect as of the date before the enactment of this Act. SEC. 1340 2 . NOTIFICATION IN T H E CASE OF BREACH. (a) IN GENERAL.—A covered entity that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured protected health information (as defined in subsection (h)(1)) shall, in the case of a breach of such information that is discovered by the covered entity, notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, or disclosed as a result of such breach. (b) N OTIFICATION OF COVERED E NTITY B Y BUSINESS ASSO- CIATE.—A business associate of a covered entity that accesses, main- tains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured protected health information shall, following the discovery of a breach of such information, notify the covered entity of such breach. Such notice shall include the identification of each individual whose unsecured protected health information has been, or is reasonably believed by the business associate to have been, accessed, acquired, or disclosed during such breach. (c) BREAC H ES TREATED AS D ISCOVERED.—For purposes of this section, a breach shall be treated as discovered by a covered entity or by a business associate as of the first day on which such breach is known to such entity or associate, respectively, (including any 42USC1793 2 . 42 USC 17931.


text:
Page:United States Statutes at Large Volume 123.djvu/281

 123STA T . 2 6 1 PUBLIC LA W 111 –5—FE B.1 7, 2 0 0 9person, o th er th a n the i n d i v id u a lc o m mittin g the b reach, that is an emplo y ee, o f ficer, or other agent of such entity or associate, respectively ) or should reasonably have been k no w n to such entity or associate ( or person) to have occurred . (d) TIMEL I N E S S OFN O T IFI CA TION. — ( 1 ) I N G ENE R AL.— S ub j ect to subsection (g), all notifications re q uired under this section shall be made without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach by the covered entity involved (or business associate involved in the case of a notification required under subsection (b)). ( 2 ) BU R D EN OF P ROOF.—The covered entity involved (or business associate involved in the case of a notification required under subsection (b)), shall have the burden of demonstrating that all notifications were made as required under this part, including evidence demonstrating the necessity of any delay. (e) M ET H ODS OF NOTICE.— (1) INDI V IDUAL NOTICE.—Notice required under this section to be provided to an individual, with respect to a breach, shall be provided promptly and in the following form ( A ) W ritten notification by first - class mail to the indi- vidual (or the ne x t of kin of the individual if the individual is deceased) at the last known address of the individual or the next of kin, respectively, or, if specified as a pref- erence by the individual, by electronic mail. The notification may be provided in one or more mailings as information is available. (B) In the case in which there is insufficient, or out- of-date contact information (including a phone number, email address, or any other form of appropriate communica- tion) that precludes direct written (or, if specified by the individual under subparagraph (A), electronic) notification to the individual, a substitute form of notice shall be pro- vided, including, in the case that there are 10 or more individuals for which there is insufficient or out-of-date contact information, a conspicuous posting for a period determined by the Secretary on the home page of the Web site of the covered entity involved or notice in major print or broadcast media, including major media in geographic areas where the individuals affected by the breach likely reside. Such a notice in media or web posting will include a toll-free phone number where an individual can learn whether or not the individual ’ s unsecured pro- tected health information is possibly included in the breach. ( C ) In any case deemed by the covered entity involved to require urgency because of possible imminent misuse of unsecured protected health information, the covered entity, in addition to notice provided under subparagraph (A), may provide information to individuals by telephone or other means, as appropriate. (2) MEDIA NOTICE.—Notice shall be provided to prominent media outlets serving a State or jurisdiction, following the discovery of a breach described in subsection (a), if the unsecured protected health information of more than 5 00 resi- dents of such State or jurisdiction is, or is reasonably believed to have been, accessed, acquired, or disclosed during such breach. Webposting.D e adl ine.


text:
Page:United States Statutes at Large Volume 123.djvu/282

 123STA T . 2 6 2 PUBLIC LA W 111 –5—FE B.1 7, 2 0 0 9(3)NOTICE TO S EC R ET A R Y.— N oticeshal l b e pr o v i d ed to the S ecretar y by covered e n tities o fu nsecured protected health infor m ation that has been ac q uired or disclosed in a breach. I f the breach w as with respect to 50 0 or more individuals than such notice must be provided immediately. If the breach was with respect to less than 500 individuals , the covered entity may maintain a lo g of any such breach occurring and annually submit such a log to the Secretary documenting such breaches occurring during the year involved. ( 4 ) P OSTI NG ON H HS PUBL IC W EBSITE.— T he Secretary shall ma k e available to the public on the Internet website of the D epartment of H ealth and Human Services a list that identifies each covered entity involved in a breach described in subsection (a) in which the unsecured protected health information of more than 500 individuals is acquired or disclosed. (f) C ONTENT O F NOTIFICATION.— R egardless of the method by which notice is provided to individuals under this section, notice of a breach shall include, to the e x tent possible, the following ( 1 ) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known. ( 2 ) A description of the types of unsecured protected health information that were involved in the breach (such as full name, Social Security number, date of birth, home address, account number, or disability code). (3) The steps individuals should take to protect themselves from potential harm resulting from the breach. (4) A brief description of what the covered entity involved is doing to investigate the breach, to mitigate losses, and to protect against any further breaches. (5) Contact procedures for individuals to ask questions or learn additional information, which shall include a toll - free telephone number, an e-mail address, W eb site, or postal address. (g) DELAY OF NOTIFICATION AUTHORI Z E D FOR L AW E NFORCE- M ENT PURPOSES.—If a law enforcement official determines that a notification, notice, or posting required under this section would impede a criminal investigation or cause damage to national secu- rity, such notification, notice, or posting shall be delayed in the same manner as provided under section 1 6 4.52 8 (a)(2) of title 45, Code of F ederal Regulations, in the case of a disclosure covered under such section. (h) U NSECURED PROTECTED HEALTH INFORMATION.— (1) DEFINITION.— (A) IN GENERAL.—Sub j ect to subparagraph ( B ), for pur- poses of this section, the term ‘ ‘unsecured protected health information ’ ’ means protected health information that is not secured through the use of a technology or methodology specified by the Secretary in the guidance issued under paragraph (2). (B) E X CEPTION IN CASE TIMELY GUIDANCE NOT ISSUED.— In the case that the Secretary does not issue guidance under paragraph (2) by the date specified in such para- graph, for purposes of this section, the term ‘‘unsecured protected health information’’ shall mean protected health information that is not secured by a technology standard that renders protected health information unusable, List.


text: Dictionary of National Biography, 1885-1900/Montfort, Guy of


text:
Page:United States Statutes at Large Volume 123.djvu/283

 123STA T . 2 6 3 PUBLIC LA W 111 –5—FE B.1 7, 2 0 0 9unread a bl e ,o r i nde c i ph erable t o unauthori z ed indi v idual s and is developed or endorsed b y a standards developin g organization that is accredited by the Am erican N ational S tandards I nstitute .(2)GUIDANCE . —F or purposes o f paragraph ( 1 ) and section 1 3407 (f)(3), not later than the date that is 6 0 days after the date of the enactment of this Act, the Secretary shall, after consultation w ith sta k eholders, issue (and annually update) guidance specifying the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals, including the use of standards developed under section 3002(b)(2)( B )(vi) of the P ublic H ealth Service Act, as added by section 13101 of this Act. (i) R E PORT TO C ON G RE S S ON BREAC H ES.— (1) IN GENERA L .—Not later than 12 months after the date of the enactment of this Act and annually thereafter, the Sec - retary shall prepare and submit to the Committee on Finance and the Committee on Health, E ducation, L abor, and Pensions of the Senate and the Committee on W ays and M eans and the Committee on Energy and Commerce of the House of Rep- resentatives a report containing the information described in paragraph (2) regarding breaches for which notice was provided to the Secretary under subsection (e)(3). (2) IN F OR M ATION.— T he information described in this para- graph regarding breaches specified in paragraph (1) shall include— (A) the number and nature of such breaches and (B) actions taken in response to such breaches. ( j ) REGULATIONS; EFFECTI V E D ATE.—To carry out this section, the Secretary of Health and Human Services shall promulgate interim final regulations by not later than the date that is 1 8 0 days after the date of the enactment of this title. The provisions of this section shall apply to breaches that are discovered on or after the date that is 30 days after the date of publication of such interim final regulations. SEC.1340 3.E DU C ATION ON H EA L TH IN F O RM ATION P RI V AC Y . (a) REGIONAL O FFICE PRIVAC Y ADVISORS.—Not later than 6 months after the date of the enactment of this Act, the Secretary shall designate an individual in each regional office of the Depart- ment of Health and Human Services to offer guidance and education to covered entities, business associates, and individuals on their rights and responsibilities related to Federal privacy and security re q uirements for protected health information. (b) EDUCATION INITIATIVE ON U SES OF HEALTH INFORMATION.— Not later than 12 months after the date of the enactment of this Act, the Office for Civil Rights within the Department of Health and Human Services shall develop and maintain a multi-faceted national education initiative to enhance public transparency regarding the uses of protected health information, including pro- grams to educate individuals about the potential uses of their protected health information, the effects of such uses, and the rights of individuals with respect to such uses. Such programs shall be conducted in a variety of languages and present information in a clear and understandable manner. Deadlin e . Deadline. De s i g na t i o n. 42USC1793 3. Ap pli c a b ilit y . Deadlines.


text:
Page:United States Statutes at Large Volume 123.djvu/284

 123STA T . 2 64PUBLIC LA W 111 –5—FE B.1 7, 2 0 0 9SEC.1340 4. AP P LI CA T I ON O F P R I V AC Y PROVISIONS AN D PENALTIES TO BU SINESS ASSOCIATES OF COVERED ENTITIES. (a)AP P LICAT I ON O FC ONT R ACT REQU IRE M ENT S.—Inthec a s e of a bu s i ness associate of a co v e r e d entit y that obtains or creates p rotected hea l th infor m ation pursuant to a w ritten contract (or other written arran g ement) described in section 164 . 502 (e)(2) of title 45 , Code of F ederal Regulations, with such covered entity, the business associate may use and disclose such protected health information only if such use or disclosure, respectively, is in compli - ance with each applicable re q uirement of section 164.504(e) of such title. T he additional requirements of this subtitle that relate to privacy and that are made applicable with respect to covered enti- ties shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity. (b) APPLICATION OF K NO W LE DG E E LEMENTS ASSOCIATED W IT H CONTRACTS.— S ection 164.504(e)(1)(ii) of title 45, Code of Federal Regulations, shall apply to a business associate described in sub- section (a), with respect to compliance with such subsection, in the same manner that such section applies to a covered entity, with respect to compliance with the standards in sections 164.502(e) and 164.504(e) of such title, e x cept that in applying such section 164.504(e)(1)(ii) each reference to the business associate, with respect to a contract, shall be treated as a reference to the covered entity involved in such contract. (c) APPLICATION OF CI V IL AND CRIMINAL P ENALTIES.—In the case of a business associate that violates any provision of subsection (a) or (b), the provisions of sections 11 7 6 and 1177 of the Social Security Act (42 U .S.C. 1 3 20d – 5, 1320d–6) shall apply to the busi- ness associate with respect to such violation in the same manner as such provisions apply to a person who violates a provision of part C of title X I of such Act. SEC. 1340 5 . RESTRICTIONS ON CERTAIN DISCLOSURES AND SALES OF H EALTH INFOR M ATION ACCOUNTIN G OF CERTAIN PRO - TECTED HEALTH INFORMATION DISCLOSURES; ACCESS TO CERTAIN INFORMATION IN ELECTRONIC FORMAT. (a) REQUESTED RESTRICTIONS ON CERTAIN D ISCLOSURES OF H EALTH INFORMATION.—In the case that an individual requests under paragraph (a)(1)(i)(A) of section 164.522 of title 45, Code of Federal Regulations, that a covered entity restrict the disclosure of the protected health information of the individual, notwith- standing paragraph (a)(1)(ii) of such section, the covered entity must comply with the requested restriction if— (1) except as otherwise required by law, the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for purposes of carrying out treatment) and (2) the protected health information pertains solely to a health care item or service for which the health care provider involved has been paid out of poc k et in full. (b) DISCLOSURES REQUIRED TO B E L IMITED TO THE LIMITED DATA SET OR THE M INIMUM N ECESSAR Y .— (1) IN GENERAL.— (A) IN GENERAL.—Sub j ect to subparagraph (B), a cov- ered entity shall be treated as being in compliance with 42USC17935. 42 USC 17934.


text:
Page:United States Statutes at Large Volume 123.djvu/285

 123STA T . 2 65PUBLIC LA W 111 – 5 —FE B.1 7, 2 0 0 9section164.502(b) (1) o f tit l e45 ,C o d eof F ede ra l R e gu la - tions, w it h res p ect to the use, disclosure, or re q uest of protected health infor m ation described in such section, onl y if the co v ered entity limits such protected health informa- tion, to the e x tent practicable, to the limited data set (as defined in section 164.514(e)(2) of such title) or, if needed by such entity, to the minimum necessary to accom- plish the intended purpose of such use, disclosure, or request, respectively. ( B ) GUIDANCE . —N ot later than 1 8 months after the date of the enactment of this section, the S ecretary shall issue guidance on what constitutes ‘ ‘minimum necessary ’ ’ for purposes of subpart E of part 164 of title 45, Code of Federal Regulation. I n issuing such guidance the Sec- retary shall ta k e into consideration the guidance under section 1 3 424(c) and the information necessary to improve patient outcomes and to detect, prevent, and manage chronic disease. (C) SUN S E T .—Subparagraph ( A ) shall not apply on and after the effective date on which the Secretary issues the guidance under subparagraph (B). (2) D ETE RM INATI O NO F MINIMUM NECESSAR Y .—For purposes of paragraph (1), in the case of the disclosure of protected health information, the covered entity or business associate disclosing such information shall determine what constitutes the minimum necessary to accomplish the intended purpose of such disclosure. (3) A P P L ICATION OF E X CEPTIONS.— T he exceptions described in section 164.502(b)(2) of title 45, Code of Federal Regulations, shall apply to the requirement under paragraph (1) as of the effective date described in section 13423 in the same manner that such exceptions apply to section 164.502(b)(1) of such title before such date. (4) RULE OF CONSTRUCTION.—Nothing in this subsection shall be construed as affecting the use, disclosure, or request of protected health information that has been de-identified. (c) ACCOUNTIN G OF CERTAIN P ROTECTED H EALT H INFORMATION DISCLOSURES RE Q UIRED IF CO V ERED ENTITY U SES ELECTRONIC HEALTH RECORD.— ‘‘(1) IN GENERAL.—In applying section 164.528 of title 45, Code of Federal Regulations, in the case that a covered entity uses or maintains an electronic health record with respect to protected health information— ‘‘(A) the exception under paragraph (a)(1)(i) of such section shall not apply to disclosures through an electronic health record made by such entity of such information and ‘‘(B) an individual shall have a right to receive an accounting of disclosures described in such paragraph of such information made by such covered entity during only the three years prior to the date on which the accounting is requested. ‘‘(2) REGULATIONS.—The Secretary shall promulgate regula- tions on what information shall be collected about each disclo- sure referred to in paragraph (1), not later than 6 months after the date on which the Secretary adopts standards on accounting for disclosure described in the section Deadlin e . Deadline.


text:
Page:United States Statutes at Large Volume 123.djvu/286

 123STA T . 2 6 6 PUBLIC LA W 111 –5—FE B.1 7, 2 0 0 930 0 2(b) (2)( B )( iv ) ofthePu b l i cH e a lth S e r vice A ct , a s a d ded b y sectio n1 3101 . Such re g ulations shall only re q uire such infor m ation to be collected through an electronic health record in a manner that ta k es into account the interests of the individ - uals in learning the circumstances under w hich their p rotected health information is being disclosed and takes into account the administrative burden of accounting for such disclosures. ‘ ‘(3) P ROCES S. —I n response to an request from an individual for an accounting, a covered entity shall elect to provide either an— ‘‘(A) accounting, as specified under paragraph (1), for disclosures of protected health information that are made by such covered entity and by a business associate acting on behalf of the covered entity or ‘‘(B) accounting, as specified under paragraph (1), for disclosures that are made by such covered entity and pro- vide a list of all business associates acting on behalf of the covered entity, including contact information for such associates (such as mailing address, phone, and email address). A business associate included on a list under subparagraph (B) shall provide an accounting of disclosures (as required under paragraph (1) for a covered entity) made by the business asso- ciate upon a request made by an individual directly to the business associate for such an accounting. ‘‘( 4 ) EF FEC TIV E DA TE.— ‘‘(A) CU RRE N TUSERSOFE L ECTRONIC RECORDS.—In the case of a covered entity insofar as it acquired an electronic health record as of J anuary 1, 200 9, paragraph (1) shall apply to disclosures, with respect to protected health information, made by the covered entity from such a record on and after January 1, 2014. ‘‘(B) O T H ERS.—In the case of a covered entity insofar as it acquires an electronic health record after January 1, 2009, paragraph (1) shall apply to disclosures, with respect to protected health information, made by the cov- ered entity from such record on and after the later of the following ‘‘(i) January 1, 2011; or ‘‘(ii) the date that it acquires an electronic health record. ‘‘(C) L ATER DATE.— T he Secretary may set an effective date that is later that the date specified under subpara- graph (A) or (B) if the Secretary determines that such later date is necessary, but in no case may the date speci- fied under— ‘‘(i) subparagraph (A) be later than 201 6 ‘‘(ii) subparagraph (B) be later than 2013. ’ ’ (d) PROHI B ITION ON SALE OF ELECTRONIC HEALTH R ECORDS OR PROTECTED HEALTH INFOR M ATION.— (1) IN G ENERAL.—E x cept as provided in paragraph (2), a covered entity or business associate shall not directly or indirectly receive remuneration in exchange for any protected health information of an individual unless the covered entity obtained from the individual, in accordance with section 164. 5 0 8 of title 45, Code of F ederal Regulations, a valid authori z ation that includes, in accordance with such section, a specification Ap p licab ili ty.
 * or


text:
Page:United States Statutes at Large Volume 123.djvu/287

 123STA T . 2 67PUBLIC LA W 111 –5—FE B. 17 , 2 0 0 9ofwhet he r the p rote c te d he al th in for m ation can b ef u rther e x chan g ed for remuneration b y the entity recei v ing protected health information of that individual .(2)EXCEPTIONS . —P aragraph ( 1 ) s hall not apply in the fol - lowing cases ( A ) T he purpose of the exchange is for public health activities (as described in section 1 64 . 5 12(b) of title 45 ,C ode of F ederal R egulations). ( B ) The purpose of the exchange is for research (as described in sections 164.5 0 1 and 164.512(i) of title 45, Code of Federal Regulations) and the price charged reflects the costs of preparation and transmittal of the data for such purpose. (C) The purpose of the exchange is for the treatment of the individual, sub j ect to any regulation that the S ec- retary may promulgate to prevent protected health information from inappropriate access, use, or disclosure. ( D ) The purpose of the exchange is the health care operation specifically described in subparagraph (iv) of paragraph (6) of the definition of healthcare operations in section 164.501 of title 45, Code of Federal Regulations. (E) The purpose of the exchange is for remuneration that is provided by a covered entity to a business associate for activities involving the exchange of protected health information that the business associate underta k es on behalf of and at the specific re q uest of the covered entity pursuant to a business associate agreement. (F) The purpose of the exchange is to provide an indi- vidual with a copy of the individual ’ s protected health information pursuant to section 164.524 of title 45, Code of Federal Regulations. ( G ) The purpose of the exchange is otherwise deter- mined by the Secretary in regulations to be similarly nec- essary and appropriate as the exceptions provided in sub- paragraphs (A) through (F). ( 3 )RE GULA TIONS.— N ot later than 1 8 months after the date of enactment of this title, the Secretary shall promulgate regulations to carry out this subsection. I n promulgating such regulations, the Secretary— (A) shall evaluate the impact of restricting the excep- tion described in paragraph (2)(A) to require that the price charged for the purposes described in such paragraph reflects the costs of the preparation and transmittal of the data for such purpose, on research or public health activities, including those conducted by or for the use of the Food and Drug Administration and (B) may further restrict the exception described in paragraph (2)(A) to require that the price charged for the purposes described in such paragraph reflects the costs of the preparation and transmittal of the data for such purpose, if the Secretary finds that such further restriction will not impede such research or public health activities. (4) E F FECTI V E D ATE.—Paragraph (1) shall apply to exchanges occurring on or after the date that is 6 months after the date of the promulgation of final regulations imple- menting this subsection. Deadlin e .


text:
Page:United States Statutes at Large Volume 123.djvu/288

 123STA T . 2 68PUBLIC LA W 111 –5—FE B.1 7, 2 0 0 9(e)AC C ES S TOC E R T AINI N F OR M ATION IN EL ECTRONIC F ORMAT .— I nap p lyi n gs e ct i o n 164 . 52 4o f title 45 , Co d e of Fede r al R eg u lations, int h ecasethataco v ered entity uses or m aintains an electronic health record w ith respect to protected health information of an individual— (1) the individual shall have a right to o b tain from such covered entity a copy of such information in an electronic format and, if the individual chooses, to direct the covered entity to transmit such copy directly to an entity or person designated by the individual, provided that any such choice is clear, con - spicuous, and specific and (2) notwithstanding paragraph (c)(4) of such section, any fee that the covered entity may impose for providing such individual with a copy of such information (or a summary ore x planation of such information) if such copy (or summary or explanation) is in an electronic form shall not be greater than the entity ’ s labor costs in responding to the re q uest for the copy (or summary or explanation). SEC.13406 .C ONDIT IONS ON CE R T A IN CONTACTS AS P ART O FH EA L TH CARE OPERATIONS. (a) M AR K ETIN G .— (1) IN GENERAL.—A communication by a covered entity or business associate that is about a product or service and that encourages recipients of the communication to purchase or use the product or service shall not be considered a health care operation for purposes of subpart E of part 164 of title 45, Code of Federal Regulations, unless the communication is made as described in subparagraph (i), (ii), or (iii) of para- graph (1) of the definition of mar k eting in section 164.5 0 1 of such title. (2) P A Y MENT FOR CERTAIN COMM U NICATIONS.—A commu- nication by a covered entity or business associate that is described in subparagraph (i), (ii), or (iii) of paragraph (1) of the definition of marketing in section 164.501 of title 45, Code of Federal Regulations, shall not be considered a health care operation for purposes of subpart E of part 164 of title 45, Code of Federal Regulations if the covered entity receives or has received direct or indirect payment in exchange for making such communication, except where— (A)(i) such communication describes only a drug or biologic that is currently being prescribed for the recipient of the communication; and (ii) any payment received by such covered entity in exchange for making a communication described in clause (i) is reasonable in amount; ( B ) each of the following conditions apply— (i) the communication is made by the covered entity; and (ii) the covered entity making such communication obtains from the recipient of the communication, in accordance with section 164.50 8 of title 45, Code of Federal Regulations, a valid authori z ation (as described in paragraph (b) of such section) with respect to such communication; or (C) each of the following conditions apply— 42USC17936.


text:
Page:United States Statutes at Large Volume 123.djvu/289

 123STA T . 2 69PUBLIC LA W 111 –5—FE B.1 7, 2 0 09 (i)thecom m un ic a tion i s ma d e by a business asso - ciate on beha lf of the co v e r ed entity and (ii) the communication is consistent w ith the writ- ten contract (or other written arran g ement described in section 164.502 (e)(2) of such title) between such business associate and covered entity. ( 3 ) REASON A BL E I NA M O U N TD E F INED. —F or p urposes of paragraph (2) , the term ‘ ‘reasonable in amount ’ ’ shall have the meaning given such term by the S ecretary by regulation. (4) D I R E C T OR INDIRECT P A Y MENT.—For purposes of para- graph (2), the term ‘‘direct or indirect payment’’ shall not include any payment for treatment (as defined in section 164.501 of title 45, C ode of Federal Regulations) of an indi- vidual. (b) O PPORTUNITY TO OPT OUT OF FUNDRAISIN G .— T he Secretary shall by rule provide that any written fundraising communication that is a healthcare operation as defined under section 164.501 of title 45, Code of Federal Regulations, shall, in a clear and conspicuous manner, provide an opportunity for the recipient of the communications to elect not to receive any further such commu- nication. W hen an individual elects not to receive any further such communication, such election shall be treated as a revocation of authori z ation under section 164.50 8 of title 45, Code of Federal Regulations. (c) E FFECTI V E DATE.—This section shall apply to written communications occurring on or after the effective date specified under section 13423. SEC.13407 . T E MPORA R YB REAC HN OT IF ICATION RE QU IREMENT FOR V EN D ORS OF PERSONA L HEALTH RECORDS AND OTHER NON - HIPAA COVERED ENTITIES. (a) I N G ENERAL.—In accordance with subsection (c), each vendor of personal health records, following the discovery of a breach of security of unsecured PH R identifiable health information that is in a personal health record maintained or offered by such vendor, and each entity described in clause (ii), (iii), or (iv) of section 13424(b)(1)( A ), following the discovery of a breach of security of such information that is obtained through a product or service provided by such entity, shall— (1) notify each individual who is a citizen or resident of the U nited States whose unsecured PHR identifiable health information was ac q uired by an unauthorized person as a result of such a breach of security; and (2) notify the Federal Trade Commission. (b) N OTIFICATION BY T H IRD PARTY SERVICE PROVIDERS.—A third party service provider that provides services to a vendor of personal health records or to an entity described in clause (ii), (iii). or (iv) of section 13424(b)(1)(A) in connection with the offering or maintenance of a personal health record or a related product or service and that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured PHR identifiable health information in such a record as a result of such services shall, following the discovery of a breach of security of such information, notify such vendor or entity, respectively, of such breach. Such notice shall include the identification of each individual whose unsecured PHR identifiable health information 42USC1793 7 .Regulations .


text:
Page:United States Statutes at Large Volume 123.djvu/290

 123STA T . 2 70PUBLIC LA W 111 –5—FE B. 17 , 200 9hasbe e n,ori s reasonab ly belie v e dt o have been, a c cessed, ac qu ired, or disclosed durin g such breach .( c )AP P LICAT I ON O FREQU I R E M ENT S FOR T IMELINESS, M ET H O D , AND C ONTENT OF N OTIFICATIONS. —S ubsections (c), (d), (e), and ( f ) of section 13402 shall a p ply to a notification required under sub - section (a) and a vendor of personal health records, an entity described in subsection (a) and a third party service provider described in subsection (b), w ith respect to a breach of security under subsection (a) of unsecured PH R identifiable health infor m a- tion in such records maintained or offered by such vendor, in a manner specified by the F ederal Trade Commission. (d) NOTIFICATION OF THE SECRETAR Y .— U pon receipt of a notification of a breach of security under subsection (a)(2), the Federal Trade Commission shall notify the Secretary of such breach. (e) E NFORCEMENT.—A violation of subsection (a) or (b) shall be treated as an unfair and deceptive act or practice in violation of a regulation under section 1 8 (a)(1)( B ) of the Federal Trade Commission Act (1 5 U.S.C. 5 7a (a)(1)(B)) regarding unfair or decep- tive acts or practices. (f) D EFINITIONS.—For purposes of this section (1) BREACH OF SECURITY.—The term ‘ ‘breach of security ’ ’ means, with respect to unsecured PHR identifiable health information of an individual in a personal health record, acquisition of such information without the authori z ation of the individual. (2) PHR IDENTIFIA B LE HEALTH INFORMATION.—The term ‘‘PHR identifiable health information’’ means individually identifiable health information, as defined in section 1171( 6 ) of the Social Security Act (42 U.S.C. 1320d(6)), and includes, with respect to an individual, information— (A) that is provided by or on behalf of the individual and (B) that identifies the individual or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual. (3) UNSECURED PHR IDENTIFIABLE HEALTH INFORMATION.— (A) I N G ENERAL.—Sub j ect to subparagraph (B), the term ‘‘unsecured PHR identifiable health information’’ means PHR identifiable health information that is not protected through the use of a technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2). (B) E X CEPTION IN CASE TIMELY GUIDANCE NOT ISSUED.— In the case that the Secretary does not issue guidance under section 13402(h)(2) by the date specified in such section, for purposes of this section, the term ‘‘unsecured PHR identifiable health information’’ shall mean PHR identifiable health information that is not secured by a technology standard that renders protected health informa- tion unusable, unreadable, or indecipherable to unauthor- ized individuals and that is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute. (g) REGULATIONS; EFFECTI V E DATE; SUNSET.— (1) REGULATIONS; EFFECTIVE DATE.—To carry out this sec- tion, the Federal Trade Commission shall promulgate interim final regulations by not later than the date that is 180 days


text:
Page:United States Statutes at Large Volume 123.djvu/291

 123STA T . 2 7 1 PUBLIC LA W 111 –5—FE B. 17 , 2 0 0 9after t h e d ate o fthee n a c t m ent of th is section .T he p ro v isions of this section sha l l appl y to b reaches of sec u rity that are discovered on or after the date that is 30 days after the date of publication of such interim final re g ulations. (2)SUNSET . —I f C ongress enacts ne w legislation estab - lishing re q uirements for notification in the case of a breach of security , that apply to entities that are not covered entities or business associates, the provisions of this section shall not apply to breaches of security discovered on or after the effective date of regulations implementing such legislation. SEC.13408 . BU S IN ESS A SS O CIA T E CONT R ACTS RE Q UIRE DF OR CER - TAIN ENTITIES. E ach organi z ation, with respect to a covered entity, that pro- vides data transmission of protected health information to such entity (or its business associate) and that requires access on a routine basis to such protected health information, such as a H ealth Information E x change O rganization, R egional Health Information Organization, E-prescribing G ateway, or each vendor that contracts with a covered entity to allow that covered entity to offer a personal health record to patients as part of its electronic health record, is required to enter into a written contract (or other written arrange- ment) described in section 164 . 5 02(e)(2) of title 45, Code of F ederal Regulations and a written contract (or other arrangement) described in section 164.30 8 (b) of such title, with such entity and shall be treated as a business associate of the covered entity for purposes of the provisions of this subtitle and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of the date of enactment of this title. SEC. 1340 9 .C L ARIFICATION OF A P PLICATION OF W RON G FUL DISCLO- SURES CRI M INAL PENALTIES. Section 11 7 7(a) of the Social Security A ct (42 U .S.C. 1320d – 6(a)) is amended by adding at the end the following new sentence

‘For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HI P AA privacy regulation described in section 1180(b)(3)) and the individual obtained or disclosed such informa- tion without authorization. ’ ’. SEC. 13410. IMPRO V ED ENFORCEMENT. (a) IN GENE RAL .— (1) NO N C O MP L I ANCE D UE TO W ILL F UL NE G LECT.—Section 1176 of the Social Security Act (42 U.S.C. 1320d–5) is amended— (A) in subsection (b)(1), by stri k ing ‘‘the act constitutes an offense punishable under section 1177’’ and inserting ‘‘a penalty has been imposed under section 1177 with respect to such act’’ and ( B ) by adding at the end the following new subsection: ‘‘(c) NONCOMPLIANCE D UE TO W ILLFUL NEGLECT.— ‘‘(1) IN GENERAL.—A violation of a provision of this part due to willful neglect is a violation for which the Secretary is required to impose a penalty under subsection (a)(1). ‘‘(2) RE Q UIRED IN V ESTIGATION.—For purposes of paragraph (1), the Secretary shall formally investigate any complaint of 42USC1793 9 . 42 USC 1793 8 . Ap p licab ili ty .


text:
Page:United States Statutes at Large Volume 123.djvu/292

 123STA T . 2 7 2 PUBLIC LA W 111 –5—FE B. 17 , 2 0 0 9aviol a t io n o f a pr ovi s ionoft h ispartifapr e li m inar y investi g a - tion of the fa c ts of the complaint in d icate s u ch a possi b le violation due to w illful neglect .’ ’. (2)ENFORCEM EN TU N D ER S OC IAL SECURIT Y ACT. —A ny viola- tion by a covered entity under thus subtitle is sub j ect to enforce- ment and penalties under section 1 1 76 and 1177 of the S ocial Security Act. (b) EFFECTI V E D ATE E G ULATIONS.— (1) T he amendments made by subsection (a) shall apply to penalties imposed on or after the date that is 2 4 months after the date of the enactment of this title. (2) N ot later than 1 8 months after the date of the enact- ment of this title , the Secretary of H ealth and Human Services shall promulgate regulations to implement such amendments. (c) DISTRI B UTION OF C ERTAIN CIVIL M ONETARY P ENALTIES COL- LECTED.— (1) I N GENERAL.—Subject to the regulation promulgated pursuant to paragraph ( 3 ), any civil monetary penalty or mone- tary settlement collected with respect to an offense punishable under this subtitle or section 1176 of the Social Security Act (42 U .S.C. 132 0 d –5 ) insofar as such section relates to privacy or security shall be transferred to the O ffice for Civil Rights of the Department of Health and Human Services to be used for purposes of enforcing the provisions of this subtitle and subparts C and E of part 164 of title 45, Code of F ederal Regulations, as such provisions are in effect as of the date of enactment of this Act. (2) G AO RE P ORT.—Not later than 18 months after the date of the enactment of this title, the Comptroller General shall submit to the Secretary a report including recommenda- tions for a methodology under which an individual who is harmed by an act that constitutes an offense referred to in paragraph (1) may receive a percentage of any civil monetary penalty or monetary settlement collected with respect to such offense. (3) ESTABLIS H MENT OF METHODOLOGY TO DISTRIBUTE PERCENTAGE OF CMPS COLLECTED TO HARMED INDIVIDUALS.— Not later than 3 years after the date of the enactment of this title, the Secretary shall establish by regulation and based on the recommendations submitted under paragraph (2), a methodology under which an individual who is harmed by an act that constitutes an offense referred to in paragraph (1) may receive a percentage of any civil monetary penalty or monetary settlement collected with respect to such offense. (4) APPLICATION OF METHODOLOGY.—The methodology under paragraph (3) shall be applied with respect to civil mone- tary penalties or monetary settlements imposed on or after the effective date of the regulation. (d) TIERED INCREASE IN AMOUNT OF CIVIL MONETARY PEN- ALTIES.— (1) IN GENERAL.—Section 1176(a)(1) of the Social Security Act (42 U.S.C. 1320d–5(a)(1)) is amended by stri k ing ‘ ‘who violates a provision of this part a penalty of not more than’’ and all that follows and inserting the following ‘‘who violates a provision of this part— ‘‘(A) in the case of a violation of such provision in which it is established that the person did not know (and Deadlin e . Deadline.
 * R


text:
Page:United States Statutes at Large Volume 123.djvu/293

 123STA T . 2 7 3 PUBLIC LA W 111 –5—FE B. 17 , 2 0 0 9byex e rcis i ng re a s o nab l e d iligence w o u ld no th a v e k nown ) that such p erson violated such provision, a penalty f or each such violation of an a m ount that is at least the amount described in paragraph (3 )( A ) but not to exceed the amount described in paragraph (3)( D ) ‘( B ) in the case of a violation of such provision in which it is established that the violation was due to reason - able cause and not to willful neglect, a penalty for each such violation of an amount that is at least the amount described in paragraph (3)(B) but not to exceed the amount described in paragraph (3)(D); and ‘‘( C ) in the case of a violation of such provision in which it is established that the violation was due to willful neglect — ‘‘(i) if the violation is corrected as described in subsection (b)(3)(A), a penalty in an amount that is at least the amount described in paragraph (3)(C) but not to exceed the amount described in paragraph (3)(D); and ‘‘(ii) if the violation is not corrected as described in such subsection, a penalty in an amount that is at least the amount described in paragraph (3)(D) .I n determining the amount of a penalty under this section for a violation, the S ecretary shall base such determination on the nature and extent of the violation and the nature and extent of the harm resulting from such violation. ’ ’. ( 2 ) TIERSOFP E NALT IES D ES C RI B ED.—Section 1 1 76 (a) of such Act ( 4 2 U .S.C. 132 0 d –5 (a)) is further amended by adding at the end the following new paragraph ‘‘(3) TIERS OF PENALTIES DESCRIBED.— F or purposes of para- graph (1), with respect to a violation by a person of a provision of this part— ‘‘(A) the amount described in this subparagraph is $ 100 for each such violation, except that the total amount imposed on the person for all such violations of an identical re q uirement or prohibition during a calendar year may not exceed $25,000; ‘‘(B) the amount described in this subparagraph is $1,000 for each such violation, except that the total amount imposed on the person for all such violations of an identical requirement or prohibition during a calendar year may not exceed $100,000; ‘‘(C) the amount described in this subparagraph is $10,000 for each such violation, except that the total amount imposed on the person for all such violations of an identical requirement or prohibition during a calendar year may not exceed $250,000; and ‘‘(D) the amount described in this subparagraph is $50,000 for each such violation, except that the total amount imposed on the person for all such violations of an identical requirement or prohibition during a calendar year may not exceed $1,500,000.’’. (3) CONFOR M IN G AMENDMENTS.—Section 1176(b) of such Act (42 U.S.C. 1320d–5(b)) is amended— (A) by striking paragraph (2) and redesignating para- graphs (3) and (4) as paragraphs (2) and (3), respectively; and


text:
Page:United States Statutes at Large Volume 123.djvu/294

 123STA T . 2 74PUBLIC LA W 111 –5—FE B. 17 , 2 0 0 9(B)inpar a g rap h ( 2 ), a s s o r ed esigna t ed — (i)ins ub paragraph ( A ),b y stri k ing ‘ ‘in subpara - graph (B), a pena l ty m ay not be imposed under sub- se c tion (a) i f’ ’ and all that follo w s through ‘‘the failure to comply is corrected’’ and inserting ‘‘in subparagraph (B) or subsection (a)( 1 )( C ), a penalty may not be imposed under subsection (a) if the failure to comply is corrected’’ and (ii) in subparagraph (B), by striking ‘‘(A)(ii)’’ and inserting ‘‘(A)’’ each place it appears . ( 4 ) EF F ECTIV E DA TE.— T he amendments made by this sub- section shall apply to v iolations occurring after the date of the enactment of this title. (e) E N F OR CE M ENT T H RO UG H S TATE ATTORNE YSG ENERA L .— (1) I N GENERAL.—Section 11 76 of the Social Security Act (42 U .S.C. 1 3 2 0 d –5 ) is amended by adding at the end the following new subsection ‘‘(d) ENFORCEMENT B Y STATE ATTORNEYS GENERAL.— ‘‘(1) CIVIL ACTION.—E x cept as provided in subsection (b), in any case in which the attorney general of a State has reason to believe that an interest of one or more of the residents of that State has been or is threatened or adversely affected by any person who violates a provision of this part, the attorney general of the State, as parens patriae, may bring a civil action on behalf of such residents of the State in a district court of the United States of appropriate j urisdiction— ‘‘(A) to enjoin further such violation by the defendant; or ‘‘(B) to obtain damages on behalf of such residents of the State, in an amount e q ual to the amount determined under paragraph (2). ‘‘(2) STATUTORY DAMAGES.— ‘‘(A) IN GENERAL.— F or purposes of paragraph (1)(B), the amount determined under this paragraph is the amount calculated by multiplying the number of violations by up to $ 100. For purposes of the preceding sentence, in the case of a continuing violation, the number of violations shall be determined consistent with the H I P AA privacy regulations (as defined in section 11 8 0(b)(3)) for violations of subsection (a). ‘‘(B) L IMITATION.—The total amount of damages imposed on the person for all violations of an identical requirement or prohibition during a calendar year may not exceed $25,000. ‘‘(C) R EDUCTION OF DAMAGES.—In assessing damages under subparagraph (A), the court may consider the factors the Secretary may consider in determining the amount of a civil money penalty under subsection (a) under the HIPAA privacy regulations. ‘‘(3) ATTORNEY FEES.—In the case of any successful action under paragraph (1), the court, in its discretion, may award the costs of the action and reasonable attorney fees to the State. ‘‘(4) N OTICE TO SECRETARY.—The State shall serve prior written notice of any action under paragraph (1) upon the Secretary and provide the Secretary with a copy of its com- plaint, except in any case in which such prior notice is not Records.


text:
Page:United States Statutes at Large Volume 123.djvu/295

 123STA T . 2 75PUBLIC LA W 111 – 5 —FE B. 17 , 2 0 0 9feasibl e , i nwh i c h case t he S tate shall se rv es u chn o tice i m me -d iatel y u p on institutin g such action .T he Secretary shall have the right —‘ ‘ (A) to intervene in the action ‘‘( B ) upon so intervening, to be heard on all matters arising therein; and ‘‘( C ) to file petitions for appeal. ‘‘( 5 )C ONSTRUC T I ON.— F or purposes of bringing any civil action under paragraph ( 1 ), nothing in this section shall be construed to prevent an attorney general of a State from e x er- cising the powers conferred on the attorney general by the laws of that State. ‘‘( 6 ) VE NUE; SER V ICE O FP ROCESS.— ‘‘(A) VENUE.—Any action brought under paragraph (1) may be brought in the district court of the U nited States that meets applicable re q uirements relating to venue under section 1 39 1 of title 28, United States Code. ‘‘(B) SERVICE OF PROCESS.— I n an action brought under paragraph (1), process may be served in any district in which the defendant— ‘‘(i) is an inhabitant; or ‘‘(ii) maintains a physical place of business. ‘‘( 7 ) L I M IT A TION ON STATE ACTION WH I L EFE D ERAL ACTION IS PENDIN G .—If the Secretary has instituted an action against a person under subsection (a) with respect to a specific violation of this part, no State attorney general may bring an action under this subsection against the person with respect to such violation during the pendency of that action. ‘‘(8) APPLICATION OF CMP STATUTE OF LIMITATION.—A civil action may not be instituted with respect to a violation of this part unless an action to impose a civil money penalty may be instituted under subsection (a) with respect to such violation consistent with the second sentence of section 1128A(c)(1). ’ ’. (2) CONFORMING AMENDMENTS.—Subsection (b) of such sec- tion, as amended by subsection (d)(3), is amended— (A) in paragraph (1), by stri k ing ‘‘A penalty may not be imposed under subsection (a)’’ and inserting ‘‘ N o penalty may be imposed under subsection (a) and no damages obtained under subsection (d)’’; (B) in paragraph (2)(A)— (i) after ‘‘subsection (a)(1)(C),’’, by striking ‘‘a pen- alty may not be imposed under subsection (a)’’ and inserting ‘‘no penalty may be imposed under subsection (a) and no damages obtained under subsection (d)’’; and (ii) in clause (ii), by inserting ‘‘or damages’’ after ‘‘the penalty’’; (C) in paragraph (2)(B)(i), by striking ‘‘The period’’ and inserting ‘‘ W ith respect to the imposition of a penalty by the Secretary under subsection (a), the period’’; and ( D ) in paragraph (3), by inserting ‘‘and any damages under subsection (d)’’ after ‘‘any penalty under subsection (a)’’. (3) E FFECTIVE DATE.—The amendments made by this sub- section shall apply to violations occurring after the date of the enactment of this Act.


text:
Page:United States Statutes at Large Volume 123.djvu/296

 123STA T . 2 76PUBLIC LA W 111 –5—FE B. 17 , 2 0 0 9(f)AL L OWINGC ON T IN UEDUS EO F CO R RE C TI V E ACTION .—Suchse c tion is fu r ther am en d ed by addin g at the end the fo l lo w ing new subsection

‘(e) ALLOWING CONTINUED USE OF CORRECTIVE ACTION.— N othing in this section shall be construed as p re v enting the O ffice for Civil R ights of the D epartment of H ealth and Human Services from continuing , in its discretion, to use corrective action without a penalty in cases where the person did not k now (and by e x ercising reasonable diligence would not have known) of the violation involved. ’ ’. SEC.134 11. AUDIT S. T he Secretary shall provide for periodic audits to ensure that covered entities and business associates that are sub j ect to the re q uirements of this subtitle and subparts C and E of part 164 of title 4 5, Code of F ederal Regulations, as such provisions are in effect as of the date of enactment of this Act, comply with such requirements. PART2— R EL AT IONSH IP TO OTHER LA W S RE GU LATOR Y RE F EREN C ES; EFFECTI V E D ATE; REPORTS SEC. 134 2 1. R E L ATI ON S H I P TO OTHER LA W S. (a) A P PLIC A TION OF HIPAA STATE P REE M PTION.—Section 11 78 of the Social Security Act (4 2 U.S.C. 1 3 2 0 d – 7) shall apply to a provision or requirement under this subtitle in the same manner that such section applies to a provision or requirement under part C of title XI of such Act or a standard or implementation specifica - tion adopted or established under sections 1172 through 1174 of such Act. (b) HEALT H INSURANCE PORTA B ILIT Y AND ACCOUNTABILITY ACT.—The standards governing the privacy and security of individ- ually identifiable health information promulgated by the Secretary under sections 262(a) and 264 of the Health Insurance Portability and Accountability Act of 1 9 96 shall remain in effect to the extent that they are consistent with this subtitle. The Secretary shall by rule amend such Federal regulations as required to make such regulations consistent with this subtitle. (c) CONSTRUCTION.—Nothing in this subtitle shall constitute a waiver of any privilege otherwise applicable to an individual with respect to the protected health information of such individual. SEC. 13422. RE G ULATOR Y RE F ERENCES. Each reference in this subtitle to a provision of the Code of Federal Regulations refers to such provision as in effect on the date of the enactment of this title (or to the most recent update of such provision). SEC. 13423. EFFECTI V E DATE. Except as otherwise specifically provided, the provisions of part I shall take effect on the date that is 12 months after the date of the enactment of this title. SEC. 13424. STUDIES , REPORTS, GUIDANCE. (a) REPORT ON COMPLIANCE.— 42USC1795 4 . 42 USC 1795 3 . 42 USC 17952. 42 USC 17951. 42 USC 1794 0.


text:
Page:United States Statutes at Large Volume 123.djvu/297

 123STA T . 2 7 7 PUBLIC LA W 111 –5—FE B. 17 , 2 0 0 9(1)INGE NE RAL.—Forthefi r s t y e a r b e g i n ning after the d ate of the ena c t m ent of this A ct and ann u a l ly thereafter , the S ecretary shall p repare and submit to the C ommittee on H ealth, E ducation, L abor, and P ensions of the Senate and the Committee on W ays and M eans and the Committee on Energy and Commerce of the House of R epresentati v es a report concerning complaints of alleged violations of la w, including the provisions of this subtitle as well as the provisions of subparts C and E of part 1 64 of title 4 5, Code of Federal Regulations, (as such provisions are in effect as of the date of enactment of this Act) relating to privacy and security of health information that are received by the Secretary during the year for which the report is being prepared. Each such report shall include, with respect to such complaints received during the year— (A) the number of such complaints ( B ) the number of such complaints resolved informally, a summary of the types of such complaints so resolved, and the number of covered entities that received technical assistance from the Secretary during such year in order to achieve compliance with such provisions and the types of such technical assistance provided; (C) the number of such complaints that have resulted in the imposition of civil monetary penalties or have been resolved through monetary settlements, including the nature of the complaints involved and the amount paid in each penalty or settlement; ( D ) the number of compliance reviews conducted and the outcome of each such review; (E) the number of subpoenas or in q uiries issued; (F) the Secretary ’ s plan for improving compliance with and enforcement of such provisions for the following year; and ( G ) the number of audits performed and a summary of audit findings pursuant to section 1 3 411. ( 2 )A V A I LA B ILI TY T OPU BLI C .—Each report under paragraph (1) shall be made available to the public on the Internet website of the Department of Health and Human Services. (b) STU D Y AND REPORT ON APPLICATION O F PRIVACY AND SECU - RITY RE Q UIRE M ENT S TO N ON-HIPAA COVERED ENTITIES.— (1) STUDY.—Not later than one year after the date of the enactment of this title, the Secretary, in consultation with the Federal T rade Commission, shall conduct a study, and submit a report under paragraph (2), on privacy and security requirements for entities that are not covered entities or busi- ness associates as of the date of the enactment of this title, including— (A) requirements relating to security, privacy, and notification in the case of a breach of security or privacy (including the applicability of an e x emption to notification in the case of individually identifiable health information that has been rendered unusable, unreadable, or indeci- pherable through technologies or methodologies recogni z ed by appropriate professional organization or standard set- ting bodies to provide effective security for the information) that should be applied to— (i) vendors of personal health records; Webposting.


text:
Page:United States Statutes at Large Volume 123.djvu/298

 123STA T . 2 78PUBLIC LA W 111 –5—FE B. 17 , 2 0 0 9(i i )ent itie s t ha t of fe rp ro duc ts or ser v ices throu g h the w e b site of a vendor of persona l health records (iii) entities that are not covered entities and that offer products or services through the websites of cov - ered entities that offer individuals personal health records; (iv) entities that are not covered entities and that access infor m ation in a personal health record or send information to a personal health record; and (v) third part y service providers used by a vendor or entity described in clause (i) , (ii), (iii), or (iv) to assist in providing personal health record products or services; ( B ) a determination of which F ederal government agency is best e q uipped to enforce such requirements rec- ommended to be applied to such vendors, entities, and service providers under subparagraph ( A ); and ( C ) a timeframe for implementing regulations based on such findings . ( 2 ) REPORT . —T he S ecretary shall submit to the Committee on Finance, the Committee on H ealth, E ducation, L abor, and P ensions, and the Committee on Commerce of the Senate and the Committee on W ays and M eans and the Committee on Energy and Commerce of the House of Representatives a report on the findings of the study under paragraph ( 1 ) and shall include in such report recommendations on the privacy and security requirements described in such paragraph. (c) GUIDANC EON IM P L EMENTATION SPECI F ICATION TO D E-IDEN- TIF Y PROTECTED HEALT H INFORMATION.— N ot later than 12 months after the date of the enactment of this title, the Secretary shall, in consultation with sta k eholders, issue guidance on how best to implement the requirements for the de-identification of protected health information under section 1 64 . 5 14(b) of title 45, Code of Federal Regulations. (d) GA O REPORT ON TREATMENT DI S CLOSURES.—Not later than one year after the date of the enactment of this title, the Comptroller General of the U nited States shall submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives a report on the best practices related to the disclosure among health care providers of protected health information of an individual for purposes of treatment of such individual. Such report shall include an e x amina- tion of the best practices implemented by States and by other entities, such as health information exchanges and regional health information organi z ations, an examination of the extent to which such best practices are successful with respect to the quality of the resulting health care provided to the individual and with respect to the ability of the health care provider to manage such best practices, and an examination of the use of electronic informed consent for disclosing protected health information for treatment, payment, and health care operations. (e) REPORT RE Q UIRED.—Not later than 5 years after the date of enactment of this section, the Government Accountability Office shall submit to Congress and the Secretary of Health and Human Services a report on the impact of any of the provisions of this


text:
Page:United States Statutes at Large Volume 123.djvu/299

 123STA T . 2 79PUBLIC LA W 111 –5—FE B. 17 , 2 0 09 Actonheal th i n sur ance p re m iums , o v erall health care costs, a d op - tion o f electronic health records by providers, and reduction in medical errors and other q uality improvements .( f )STUDY . —T he Secretary shall study the definition of ‘ ‘psycho- therapy notes ’ ’ in section 164 . 50 1 of title 45, C ode of F ederal R e g ula- tions, w ith regard to including test data that is related to direct responses, scores, items, forms, protocols, manuals, or other mate- rials that are part of a mental health evaluation, as determined by the mental health professional providing treatment or evaluation in such definitions and may, based on such study, issue regulations to revise such definition. TI T LEX I V—S T A TE F IS C AL STA B ILI Z ATI ON F U N DDEP ART M E N T O FED U CAT I ON ST A T E F ISC A L STA B ILI Z ATI ON FUND For necessary e x penses for a State Fiscal Stabili z ation Fund, $ 5 3 ,600,000,000, which shall be administered by the Department of Education. G ENERA L PRO V ISIONS—T H IS TITLE SEC.140 01. AL L O CA TI O N S. (a) OUTLYIN G A R EAS.—From the amount appropriated to carry out this title, the Secretary of Education shall first allocate up to one-half of 1 percent to the outlying areas on the basis of their respective needs, as determined by the Secretary, in consulta- tion with the Secretary of the Interior, for activities consistent with this title under such terms and conditions as the Secretary may determine. (b) AD M INISTRATION AND O V ERSIG H T.—The Secretary may, in addition, reserve up to $14,000,000 for administration and oversight of this title, including for program evaluation. (c) RESERVATION F OR ADDITIONAL PROGRAMS.—After reserving funds under subsections (a) and (b), the Secretary shall reserve $5,000,000,000 for grants under sections 14006 and 1400 7 . (d) STATE ALLOCATIONS.—After carrying out subsections (a), (b), and (c), the Secretary shall allocate the remaining funds made available to carry out this title to the States as follows (1) 61 percent on the basis of their relative population of individuals aged 5 through 2 4. (2) 3 9 percent on the basis of their relative total population. (e) STATE GRANTS.—From funds allocated under subsection (d), the Secretary shall ma k e grants to the Governor of each State. (f) REALLOCATION.—The Governor shall return to the Secretary any funds received under subsection (e) that the Governor does not award as subgrants or otherwise commit within two years of receiving such funds, and the Secretary shall reallocate such funds to the remaining States in accordance with subsection (d). SEC. 1400 2 . STATE U SES O F FUN D S. (a) EDUCATION FUND.— Grants.


text:
Page:United States Statutes at Large Volume 123.djvu/300

 123STA T . 2 80PUBLIC LA W 111 –5—FE B.1 7, 200 9(1)INGE NE RAL.—Foreachfis ca ly ear ,t he G o v er n or shall u se 8 1.8 p ercent of the S tate ’ s allocation un d er section 1 40 01(d) for the support of ele m entary, secondary, and postsecondary education and, as applica b le, early childhood education pro -g rams and services. ( 2 ) R E STO R I NG STATE S UP PORT F ORE D U C ATION.— ( A ) IN GENERAL.— T he Governor shall first use the funds described in paragraph (1)— (i) to provide the amount of funds, through the State’s primary elementary and secondary funding for- mulae, that is needed— (I) to restore, in each of fiscal years 200 9, 2010, and 2011, the level of State support provided through such formulae to the greater of the fiscal year 2008 or fiscal year 2009 level and (II) w here applicable, to allow e x isting State formulae increases to support elementary and sec- ondary education for fiscal years 2010 and 2011 to be implemented and allow funding for phasing in State e q uity and adequacy ad j ustments, if such increases were enacted pursuant to State law prior to O ctober 1, 2008. (ii) to provide, in each of fiscal years 2009, 2010, and 2011, the amount of funds to public institutions of higher education in the State that is needed to restore State support for such institutions (excluding tuition and fees paid by students) to the greater of the fiscal year 2008 or fiscal year 2009 level. ( B )S H ORTFALL.—If the Governor determines that the amount of funds available under paragraph (1) is insuffi- cient to support, in each of fiscal years 2009, 2010, and 2011, public elementary, secondary, and higher education at the levels described in clauses (i) and (ii) of subparagraph (A), the Governor shall allocate those funds between those clauses in proportion to the relative shortfall in State sup- port for the education sectors described in those clauses. ( C ) FISCAL Y EAR.—For purposes of this paragraph, the term ‘ ‘fiscal year’’ shall have the meaning given such term under State law. ( 3 )SU B GRANTS TO I M PRO V E BASIC PROGRAMS OPERATED BY LOCAL EDUCATIONAL AGENCIES.—After carrying out paragraph (2), the Governor shall use any funds remaining under para- graph (1) to provide local educational agencies in the State with subgrants based on their relative shares of funding under partAoftitleIofthe E lementary and Secondary Education Act of 19 65 (20 U .S.C. 6311 et seq.) for the most recent year for which data are available. (b) OTHER GOVERNMENT SERVICES.— (1) IN GENERAL.—The Governor shall use 18.2 percent of the State’s allocation under section 14001 for public safety and other government services, which may include assistance for elementary and secondary education and public institutions of higher education, and for moderni z ation, renovation, or repair of public school facilities and institutions of higher edu- cation facilities, including modernization, renovation, and repairs that are consistent with a recognized green building rating system.


text:
Page:United States Statutes at Large Volume 123.djvu/301

 123STA T . 2 8 1 PUBLIC LA W 111 –5—FE B.1 7, 2 0 0 9(2)AVAIL A B ILI TY T O ALL I NS TIT U TIONS O FH I G H ER E D U -C ATION .— A Govern or shal lno tc ons id erthet yp eor m ission o f an instit u tion of hi g her education , and shall consider any institution for funding for moderni z ation, renovation, and repairs w ithin the S tate that— (A) q ualifies as an institution of higher education, as defined in su b section 140 1 3 (3) and ( B ) continues to be eligible to participate in the pro- grams under title IV of the H igher E ducation Act of 1 965 . (c) R ULE OF C ONSTRUCTION.— N othing in this section shall allow a local educational agency to engage in school modernization, ren- ovation, or repair that is inconsistent with State law. SEC.140 0 3 . U SES OF FU ND S BYL OC A L EDUCA TI ONAL A G ENCIES. (a) IN GENERAL.—A local educational agency that receives funds under this title may use the funds for any activity authorized by the Elementary and Secondary Education Act of 1965 (20 U .S.C. 6301 et seq.) ( ‘ ‘ESEA ’ ’), the Individuals with D isabilities Education Act (20 U.S.C. 1400 et seq.) (‘‘IDEA’’), the Adult and F amily L iteracy Act (20 U.S.C. 1400 et seq.), or the Carl D. P er k ins Career and T echnical Education Act of 2006 (20 U.S.C. 2301 et seq.) (‘‘the Perkins Act’’) or for modernization, renovation, or repair of public school facilities, including modernization, renovation, and repairs that are consistent with a recognized green building rating system. (b) PROHIBITION.—A local educational agency may not use funds received under this title for— (1) payment of maintenance costs; (2) stadiums or other facilities primarily used for athletic contests or e x hibitions or other events for which admission is charged to the general public; (3) purchase or upgrade of vehicles; or (4) improvement of stand-alone facilities whose purpose is not the education of children, including central office adminis- tration or operations or logistical support facilities. (c) RULE OF CONSTRUCTION.—Nothing in this section shall allow a local educational agency to engage in school modernization, ren- ovation, or repair that is inconsistent with State law. SEC. 14004. USES OF FUNDS BY INSTITUTIONS OF H IGHE R EDUCATION. (a) IN GENERAL.—A public institution of higher education that receives funds under this title shall use the funds for education and general expenditures, and in such a way as to mitigate the need to raise tuition and fees for in-State students, or for moderniza- tion, renovation, or repair of institution of higher education facilities that are primarily used for instruction, research, or student housing, including modernization, renovation, and repairs that are consistent with a recognized green building rating system. (b) PROHIBITION.—An institution of higher education may not use funds received under this title to increase its endowment. (c) ADDITIONAL PROHIBITION.—No funds awarded under this title may be used for— (1) the maintenance of systems, equipment, or facilities; (2) modernization, renovation, or repair of stadiums or other facilities primarily used for athletic contests or exhibitions or other events for which admission is charged to the general public; or (3) modernization, renovation, or repair of facilities—


text:
Page:United States Statutes at Large Volume 123.djvu/302

 123STA T . 2 8 2 PUBLIC LA W 111 –5—FE B.1 7, 2 0 0 9(A)usedfor se cta r i a n instruction or re l i g ious w ors h i p; or ( B )inwhichasu b stantial portion of the functions of the facilities are subsu m ed in a religious mission .SEC.140 0 5 .S TA TEA P P LI CATI ON S. (a) INGE NE RAL . —T he Go v ernor of a S tate desiring to receive an allocation under section 140 01 shall submit an application at such time , in such manner, and containing such information as the Secretar y may reasonably re q uire. (b) A P PL IC A T I O N.—In such application, the Governor shall— (1) include the assurances described in subsection (d); ( 2 ) provide baseline data that demonstrates the State ’ s current status in each of the areas described in such assurances; and ( 3 ) describe how the State intends to use its allocation, including whether the State will use such allocation to meet maintenance of effort requirements under the E SEA and I D EA and, in such cases, what amount will be used to meet such requirements. (c) INCENTI V E GRANT APPLICATION.—The Governor of a State see k ing a grant under section 1400 6 shall— (1) submit an application for consideration; (2) describe the status of the State’s progress in each of the areas described in subsection (d), and the strategies the State is employing to help ensure that students in the sub - groups described in section 1111(b)(2)( C )(v)(II) of the ESEA (20 U .S.C. 6311(b)(2)(C)(v)(II)) who have not met the State’s proficiency targets continue making progress toward meeting the State’s student academic achievement standards; (3) describe the achievement and graduation rates (as described in section 1111(b)(2)(C)(vi) of the ESEA (20 U.S.C. 6311(b)(2)(C)(vi)) and as clarified in section 200.1 9 (b)(1) of title 34, Code of F ederal R egulations) of public elementary and secondary school students in the State, and the strategies the State is employing to help ensure that all subgroups of students identified in section 1111(b)(2) of the ESEA (20 U.S.C. 6311(b)(2)) in the State continue making progress toward meeting the State’s student academic achievement standards; (4) describe how the State would use its grant funding to improve student academic achievement in the State, including how it will allocate the funds to give priority to high-need local educational agencies; and ( 5 ) include a plan for evaluating the State’s progress in closing achievement gaps. (d) A S S U RANCES.—An application under subsection (b) shall include the following assurances (1) M AINTENANCE O F EFFORT.— (A) ELE M ENTAR Y AN D SECONDARY EDUCATION.—The State will, in each of fiscal years 2009, 2010, and 2011, maintain State support for elementary and secondary edu- cation at least at the level of such support in fiscal year 2006. (B) H I GH ER EDUCATION.—The State will, in each of fiscal years 2009, 2010, and 2011, maintain State support for public institutions of higher education (not including support for capital pro j ects or for research and development


text:
Page:United States Statutes at Large Volume 123.djvu/303

 123STA T . 2 8 3 PUBLIC LA W 111 –5—FE B.1 7, 2 0 0 9ortui tio na n dfe e sp aid by students ) at l east at t h ele v el of su c h support in fiscal year 20 0 6.( 2) ACHIEV I NG E QU I TY IN TE A CHE RD I S TRI B UTI O N. —T he S tate w ill ta k e actions to i m prove teacher effectiveness and comply with section 1 111(b)( 8 )( C ) of the E SEA (20 U .S.C. 6 3 11(b)(8)(C)) in order to address ine q uities in the distribution of hi g hly qualified teachers between high - and low-poverty schools, and to ensure that low-income and minority children are not taught at higher rates than other children by ine x peri- enced, unqualified, or out-of-field teachers. (3) IMP ROVING CO L LECTION AND USE O F DATA.—The State will establish a longitudinal data system that includes the elements described in section 6 4 01(e)(2)( D ) of the America C OMP ETES Act (20 U.S.C. 9 8 7 1). (4) STANDARDS AND ASSESSMENTS.—The State— (A) will enhance the quality of the academic assess- ments it administers pursuant to section 1111(b)(3) of the ESEA (20 U.S.C. 6311(b)(3)) through activities such as those described in section 6112(a) of such Act (20 U.S.C. 7301a(a)) ( B ) will comply with the requirements of paragraphs (3)(C)(ix) and (6) of section 1111(b) of the ESEA (20 U.S.C. 6311(b)) and section 612(a)(16) of the IDEA (20 U.S.C. 1412(a)(16)) related to the inclusion of children with disabil- ities and limited English proficient students in State assessments, the development of valid and reliable assess- ments for those students, and the provision of accommoda- tions that enable their participation in State assessments; and (C) will take steps to improve State academic content standards and student academic achievement standards consistent with section 6401(e)(1)(9)(A)(ii) of the America COMPETES Act. ( 5 ) SUPPORTING STRUGGLING SCHOOLS.—The State will ensure compliance with the requirements of section 1116(a)(7)(C)(iv) and section 1116(a)(8)(B) of the ESEA with respect to schools identified under such sections. SEC.140 0 6 .S TA TE IN CENTI V E GR ANTS. (a) IN G ENERAL.— (1) R ESERVATION.— F rom the total amount reserved under section 14001(c) that is not used for section 14007, the Secretary may reserve up to 1 percent for technical assistance to States to assist them in meeting the ob j ectives of paragraphs (2), (3), (4), and (5) of section 14005(d). (2) REMAINDER.—Of the remaining funds, the Secretary shall, in fiscal year 2010, make grants to States that have made significant progress in meeting the objectives of para- graphs (2), (3), (4), and (5) of section 14005(d). (b) BASIS FOR GRANTS.—The Secretary shall determine which States receive grants under this section, and the amount of those grants, on the basis of information provided in State applications under section 14005 and such other criteria as the Secretary deter- mines appropriate, which may include a State ’ s need for assistance to help meet the objective of paragraphs (2), (3), (4), and (5) of section 14005(d).