,,ii  #aadth ,,congress  #b;d ,session  
,s4 #cecj  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,december #h1  
#bjaf ,mr4 ,cassidy introduced the      
following bill2 which was read twice and
 referred to the ,committee on ,health1 
,education1 ,labor1 and ,pensions  ,a   
,,bill  ,to allow the use of claims1    
eligibility1 and payment data to produce
 reports1 analyses1 and presentations to
 benefit ,medicare1 and other similar   
health insurance programs1 entities1    
researchers1 and health care providers1 
to help develop cost saving approaches1 
standards1 and reference materials and  
to support medical care and improved    
payment models4  #a4 ,short title  ,this
 ,act may be cited as the ,ensuring     
,patient ,access to ,healthcare ,records
 ,act of #bjaf4  #b4 ,promotion of      
access to data1 via research and user   
friendly presentations and applications 
7a7 ,in general ,subtitle ,d of the     
,health ,information ,technology for    
,economic and ,clinical ,health ,act    

7#db ,u4,s4,c4 #agiba et seq47 is       
amended by adding at the end the        
following3  #c ,health care             
clearinghouses2 data processing to      
empower patients and improve the health 
care system  #acdea4 ,modernizing the   
role of clearinghouses in health care   
7a7 ,efforts ,to promote access to and  
leveraging of health information  7#a7  
,in general ,the ,secretary shall1      
through the updating of existing        
policies and development of policies    
that support dynamic technology         
solutions1 promote patient access to    
information related to their care1      
including real world outcomes and       
economic data 7including claims1        
eligibility1 and payment data71 in a    
manner that would ensure that such      
information is available in a form      
convenient for the patient1 in a        
reasonable manner1 and without burdening
 the health care provider involved4     
7#b7 ,requirement ,activities carried   
out under paragraph 7#a7 shall include  

the development of policies to enable   
covered entities with access to health  
information to--  7,a7 provide patient  
access to information related to their  
care1 including real world outcomes and 
economic data2 and  7,b7 develop patient
 engagement tools1 reports1 analyses1   
and presentations based on population   
health1 epidemiological1 and health     
services outcomes data1 that may        
demonstrate a fiscal or treatment       
benefit to the taxpayer4  7b7 ,treatment
 as covered entity for specified        
functions  7#a7 ,in general ,with       
respect to the use and disclosure of    
protected health information1 the       
,secretary shall-- 7,a7 not consider    
health care clearinghouses that engage  
in the functions described in paragraph 
7#c7 to be business associates under    
,,hipaa-related provisions 7as defined  
in subsection 7j77#c77 regardless of the
 role of such clearinghouses in         
collecting or receiving the information2
 and  7,b7 consider such clearinghouses 

to be covered entities under such       
provisions of law for all purposes4     
,such clearinghouses shall not be       
considered business associates for data 
translation1 analytic1 cloud computing1 
or any other purpose4  7#b7 ,data       
accuracy and security requirement ,in   
order to use health data as authorized  
by this section1 a clearinghouse or     
other covered entity engaging in        
activities authorized under this section
 shall be certified to have the         
necessary expertise and technical       
infrastructure to ensure the accuracy   
and security of such claims1            
eligibility1 and payment data through   
receipt of an accreditation by the      
,electronic ,healthcare ,network        
,accreditation ,commission1 or by an    
equivalent accreditation program        
determined appropriate by the           
,secretary4  7#c7 ,enhancing treatment1 
quality improvement1 research1 public   
health efforts and other functions  7,a7
 ,equivalent authority to other covered 

entities ,subject to paragraph 7#b71 a  
health care clearinghouse shall-- 7i7 in
 addition to carrying out claims        
processing functions1 be permitted to   
use and disclose protected health       
information in the same manner as other 
covered entities1 including for purposes
 of treatment1 payment1 health care     
operations as permitted by section      
#afd4ejf of title #de1 ,code of ,federal
 ,regulations1 research1 and public     
health as permitted by section #afd4eab 
of title #de1 ,code of ,federal         
,regulations1 and creating de-identified
 information as permitted by section    
#afd4ejb7;d7 of title #de1 ,code of     
,federal ,regulations2 and  7ii7 use or 
disclose protected health information as
 required by section #afd4ejb7;a77#b7 of
 title #de1 ,code of ,federal           
,regulations4  7,b7 ,additional         
authority ,subject to paragraph 7#b71 a 
health care clearinghouse and other     
covered entity shall1 in addition to    
claims processing functions1 be         

permitted to--  7i7 provide individuals 
with access to their own protected      
health information as described in      
subsection 7d72  7ii7 subject to        
subsection 7c77#b71 and on behalf of    
both covered entities and non-covered   
entities1 use and disclose protected    
health information for health care      
operations purposes 7as defined by      
section #afd4eja of title #de1 ,code of 
,federal ,regulations7 without respect  
to whether the recipient of the         
information has or had a relationship   
with the individual2  7iii7 subject to  
subsection 7c77#b71 and upon the request
 of a covered entity1 benchmark the     
operations of such covered entity       
against the operations of one or more   
other covered entities that have elected
 to participate in such benchmarking2   
and  7iv7 subject to subsection 7c77#b71
 use protected health information to    
facilitate clinical trial recruitment4  
7c7 ,authorities relating to data       
processing  7#a7 ,in general ,in        

carrying out ,,hipaa-related provisions1
 the ,secretary shall permit a health   
care clearinghouse to aggregate         
protected health information that the   
clearinghouse possesses in order to     
carry out the functions described in    
subsection 7b77#c74 ,subject to section 
#afd4ejb7;a77#e77;i7 of title #de1 ,code
 of ,federal ,regulations1 a health care
 clearinghouse may carry out the        
functions described in subsection       
7b77#c7 without obtaining individual    
authorization under section #afd4ejh of 
title #de1 ,code of ,federal            
,regulations4  7#b7 ,privacy ,for       
purposes of clauses 7ii7 through 7iv7 of
 subsection 7b77#c77;,b71 with respect  
to any report1 analysis1 or presentation
 provided by the clearinghouse to a     
third party1 such report1 analysis1 or  
presentation--  7,a7 shall include only 
de-identified data2 or  7,b7 if         
containing protected health information1
 shall include such data that is subject
 to a qualifying data use agreement 7as 

defined in subsection 7j774  7#c7 ,fee  
permitted ,nothing in this paragraph    
shall be construed to prohibit an       
individual's right to access claims and 
payment records in ,,hipaa standard     
format for a reasonable1 cost-based fee 
pursuant to section #afd4ebd7;c77#d7 of 
title #de1 ,code of ,federal            
,regulations4 ,in requesting access to  
records held by a health care           
clearinghouse1 the individual shall     
identify the health care provider or    
providers that rendered care4  7d7      
,comprehensive records at the request of
 an individual  7#a7 ,in general ,when a
 health care clearinghouse receives a   
written request from an individual for  
the protected health information of the 
individual1 the clearinghouse shall     
provide to the individual a             
comprehensive record of such information
 7across health care providers and      
health plans and longitudinal in scope71
 unless the clearinghouse determines in 
its sole discretion that providing a    

comprehensive record is not             
technologically feasible4  7#b7         
,purchase from other clearinghouses ,in 
preparing a comprehensive record for an 
individual under paragraph 7#a71 a      
health care clearinghouse may1 with the 
permission of the individual1 purchase  
the protected health information of the 
individual from one or more other health
 clearinghouses 7and the cost of such   
purchase may be included in a           
fair-market fee charged to the          
individual as provided for under        
paragraph 7#a774  7e7 ,situations not   
involving direct interaction with       
individuals ,sections #afd4djj through  
#afd4dad 7relating to breach            
notification7 and sections #afd4ebj     
through #afd4ebh 7relating to individual
 rights7 of title #de1 ,code of ,federal
 ,regulations1 shall apply to a health  
care clearinghouse that engages in the  
functions described in subsection       
7b77#c7 to the extent that such         
clearinghouse has current contact       

information pursuant to direct          
interaction with the individual         
involved4 ,in the case of each other    
individual1 the clearinghouse shall     
provide notice to the covered entity of 
any breach of unsecured protected health
 information and provide a notice of    
privacy practices on its website4  7f7  
,transition  7#a7 ,in general ,nothing  
in this section shall be construed to   
provide a health care clearinghouse     
greater authority to use and disclose   
protected health information than that  
provided to another covered entity4     
7#b7 ,existing agreements ,with respect 
to agreements entered into by a health  
care clearinghouse prior to the date of 
enactment of this section1 a provision  
of such an agreement that conflicts with
 this section shall not have any legal  
force or effect4 ,the preceding sentence
 may not be construed as affecting any  
provision of an agreement that does not 
conflict with this section4  7g7 ,safe  
harbor and clarification of liability   

,in the case of a health care           
clearinghouse that engages in a function
 described in subsection 7b71 only that 
clearinghouse may be held liable for a  
violation of a ,,hipaa-related provision
 7and a covered entity that provided    
data or data access to the clearinghouse
 shall not be liable for such           
violations74  7h7 ,enforcement ,section 
#acdaj7;a77#b7 shall apply to this      
section in the same manner as such      
section applies to parts #a and #b4  7i7
 ,relation to other laws  7#a7          
,application of ,,hitech rule ,section  
#acdba shall apply to this section in   
the same manner as such section applies 
to parts #a and #b1 except to the extent
 that such section #acdba concerns      
section #aagh7;a77#b77;,b7 of the       
,social ,security ,act4  7#b7 ,state    
laws regarding unfair or deceptive acts 
or practices ,this part shall not be    
construed to preempt the law of any     
,state that prohibits unfair or         
deceptive acts or practices4  7j7       

,definitions ,in this part3 7#a7        
,de-identified ,the term de-identified1 
with respect to health information1     
means such information that is not      
individually identifiable as determined 
in accordance with the standards under  
section #afd4ead7;b7 of title #de1 ,code
 of ,federal ,regulations4  7#b7 ,health
 care clearinghouse ,the term health    
care clearinghouse has the meaning given
 such term in section #aaga of the      
,social ,security ,act4  7#c7           
,,hipaa-related provision ,the term     
,,hipaa-related provision means the     
provisions of each of the following3    
7,a7 ,this subtitle4  7,b7 ,part ,c of  
title ,,xi of the ,social ,security     
,act4  7,c7 ,regulations promulgated    
pursuant to sections #bfb7;a7 and       
#bfd7;c7 of the ,health ,insurance      
,portability and ,accountability ,act of
 #aiif or this subtitle4  7#d7          
,individual ,the term individual1 with  
respect to protected health information1
 has the meaning applicable under       

section #afj4ajc of title #de1 ,code of 
,federal ,regulations4  7#e7 ,qualifying
 data use agreement ,the term qualifying
 data use agreement means an agreement1 
which may be electronic1 that           
establishes the permitted uses and      
disclosures of protected health         
information by the recipient consistent 
with this paragraph4 ,a qualifying data 
use agreement between the health care   
clearinghouse and the data recipient    
shall--  7,a7 establish the permitted   
uses and disclosures of such information
 by the recipient which shall be limited
 to the original purpose of disclosure  
under subsection 7b77#c77;,b72 and  7,b7
 provide that the data recipient will-- 
7i7 not use or further disclose the     
information other than as permitted by  
the qualifying data use agreement or as 
otherwise required by law2  7ii7 use    
appropriate safeguards to prevent use or
 disclosure of the information other    
than as provided for by the qualifying  
data use agreement2 and  7iii7 ensure   

that any agents to whom it provides the 
data agree to the same restrictions and 
conditions that apply to the data       
recipient with respect to such          
information4  4  7b7 ,regulations ,not  
later than #cj days after the date of   
the enactment of this ,act1 the         
,secretary of ,health and ,human        
,services shall promulgate regulations  
to carry out the amendment made by      
subsection 7a74  7c7 ,conforming        
amendment ,section #aaga7b7 of the      
,social ,security ,act 7#db ,u4,s4,c4   
#acbj;d7#b77 is amended by inserting    
before the period the following3 or     
receives a standard transaction from    
another entity and processes or         
facilitates the processing of health    
information into nonstandard format or  
nonstandard data content for the        
receiving entity4 ,such term also       
includes an entity that carries out such
 processing functions1 processes        
standard health care claims1 processes  
health care claim payments or provides  

advice on such1 and processes           
eligibility claims relating to health   
plan transactions on behalf of a ,,hipaa
 covered entity and in addition1 engages
 in any of the functions described in   
subsection 7a7 of section #acdea of the 
,health ,information ,technology for    
,economic and ,clinical ,health ,act4