,i #aaeth ,,congress #ast ,session ,h4 ,r4 #dfac ,,in ,,the ,,house ,,of ,,representatives ,december #aa1 #bjag,mrs4 ,mc,morris ,rodgers 7for herself1 ,mr4 ,kelly of ,pennsylvania1 ,mr4 ,hudson1 ,mrs4 ,blackburn1 ,mr4 ,long1 ,mr4 ,bishop of ,michigan1 ,mr4 ,paulsen1 and ,mr4 ,krishnamoorthi7 introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce1 and in addition to the ,committee on ,ways and ,means1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,a ,,bill ,to allow the use of claims1 eligibility1 and payment data to produce reports1 analyses1 and presentations to benefit ,medicare1 and other similar health insurance programs1 entities1 researchers1 and health care providers1 to help develop cost saving approaches1 standards1 and reference materials and to support medical care and improved payment models4 #a4 ,short title ,this ,act may be cited as the ,ensuring ,patient ,access to ,healthcare ,records ,act of #bjag4 #b4 ,promotion of access to data1 via research and user friendly presentations and applications 7a7 ,in general ,subtitle ,d of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agiba et seq47 is amended by adding at the end the following3 #c ,health care clearinghouses2 data processing to empower patients and improve the health care system #acdea4 ,modernizing the role of clearinghouses in health care 7a7 ,efforts ,to promote access to and leveraging of health information 7#a7 ,in general ,the ,secretary shall1 through the updating of existing policies and development of policies that support dynamic technology solutions1 promote patient access to information related to their care1 including real world outcomes and economic data 7including claims1 eligibility1 and payment data71 in a manner that would ensure that such information is available in a form convenient for the patient1 in a reasonable manner1 and without burdening the health care provider involved4 7#b7 ,requirement ,activities carried out under paragraph 7#a7 shall include the development of policies to enable covered entities with access to health information to-- 7,a7 provide patient access to information related to their care1 including real world outcomes and economic data2 7,b7 develop1 in accordance with ,,hipaa-related provisions 7as defined in subsection 7j771 patient engagement tools1 reports1 analyses1 and presentations based on population health1 epidemiological1 and health services outcomes data1 that may demonstrate a fiscal or treatment benefit to patients and health plan enrollees2 and 7,c7 promote transparency regarding the use and disclosure of health information by health care clearinghouses in accordance with the notice provisions of subsection 7e74 7b7 ,treatment as covered entity for specified functions 7#a7 ,in general ,with respect to the use and disclosure of protected health information1 the ,secretary shall-- 7,a7 not consider health care clearinghouses that engage in the functions described in paragraph 7#c7 to be business associates1 including subcontractor business associates1 under ,,hipaa-related provisions 7as defined in subsection 7j77#c77 regardless of the role of such clearinghouses in collecting or receiving the information2 and 7,b7 consider such clearinghouses to be covered entities under such provisions of law for all purposes4 ,such clearinghouses shall not be considered business associates1 or subcontractor business associates1 for translation of data into and out of standard format1 analytic1 cloud computing1 or any other purpose4 7#b7 ,data accuracy and security requirement ,in order to use health data as authorized by this section1 a clearinghouse or other covered entity engaging in activities authorized under this section shall be certified to have the necessary expertise and technical infrastructure to ensure the accuracy and security of such claims1 eligibility1 and payment data through receipt of an accreditation by the ,electronic ,healthcare ,network ,accreditation ,commission1 or by an equivalent accreditation program determined appropriate by the ,secretary4 7#c7 ,enhancing treatment1 quality improvement1 research1 public health efforts and other functions 7,a7 ,equivalent authority to other covered entities ,subject to paragraph 7#b71 a health care clearinghouse shall-- 7i7 in addition to carrying out claims processing functions1 be permitted to use and disclose protected health information without obtaining individual authorization to the same extent as other covered entities1 including for purposes of treatment1 payment1 health care operations as permitted by section #afd4ejf of title #de1 ,code of ,federal ,regulations1 research1 and public health as permitted by section #afd4eab of title #de1 ,code of ,federal ,regulations1 and creating de-identified information as permitted by section #afd4ejb7;d7 of title #de1 ,code of ,federal ,regulations2 and 7ii7 use or disclose protected health information as required by section #afd4ejb7;a77#b7 of title #de1 ,code of ,federal ,regulations4 7,b7 ,additional authority 7i7 ,a health care clearinghouse shall be permitted to provide an individual or the personal representative of such individual access to the protected health information of such individual as described in subsection 7d74 7ii7 ,all covered entities1 including a health care clearinghouse1 shall1 subject to subsection 7c77#b71 be permitted to-- 7,i7 on behalf of covered entities1 use and disclose protected health information for health care operations purposes 7as defined by section #afd4eja of title #de1 ,code of ,federal ,regulations7 without respect to whether the recipient of the information has or had a relationship with the individual2 7,,ii7 upon the request of a covered entity1 benchmark 7as defined by the ,secretary pursuant to rulemaking7 the operations of such covered entity against the operations of one or more other covered entities that have elected to participate in such benchmarking2 and 7,,iii7 use and disclose protected health information to facilitate clinical trial recruitment1 except that in the case the covered entity provides a consumer-facing portal or website that informs individuals of clinical trials conducted by the covered entity1 the covered entity shall secure opt-in consent from the individual1 or the individual's personal representative1 prior to contacting an individual regarding such clinical trials unless such covered entity already has a relationship with the individual4 7,c7 ,clarification ,nothing in this paragraph shall expand the authority of a health care clearinghouse or any other covered entity to use or disclose protected health information for marketing purposes under sections #afd4eja and #afd4ejh7;a77#c7 of title #de1 ,code of ,federal ,regulations4 7c7 ,authorities relating to data processing 7#a7 ,in general ,in carrying out ,,hipaa-related provisions1 the ,secretary shall permit a health care clearinghouse to aggregate protected health information1 within the clearinghouse and among other clearinghouses1 that the clearinghouse possesses in order to carry out the functions described in subsection 7b77#c74 ,subject to section #afd4ejb7;a77#e77;i7 of title #de1 ,code of ,federal ,regulations1 a health care clearinghouse may carry out the functions described in subsection 7b77#c7 without obtaining individual authorization under section #afd4ejh of title #de1 ,code of ,federal ,regulations4 7#b7 ,privacy ,for purposes of clauses 7ii7 through 7iv7 of subsection 7b77#c77;,b71 with respect to any report1 analysis1 or presentation provided by the covered entity to a third party1 such report1 analysis1 or presentation-- 7,a7 shall include only de-identified data2 or 7,b7 shall include1 subject to a qualifying data use agreement 7as defined in subsection 7j771 protected health information4 7#c7 ,clarification2 ,fee permitted 7,a7 ,in general ,nothing in this paragraph shall be construed as affecting an individual's right to access claims and payment records in ,,hipaa standard format1 in accordance with section #afd4ebd of title #de1 ,code of ,federal ,regulations4 7,b7 ,fee permitted ,if an individual or a personal representative of the individual requests a copy of records in ,,hipaa standard format a health care clearinghouse may charge a reasonable1 cost-based fee so far as such fee is in accordance with section #afd4ebd7;c77#d7 of title #de1 ,code of ,federal ,regulations4 7d7 ,comprehensive records at the request of an individual 7#a7 ,in general ,when a health care clearinghouse receives a written request from an individual or the personal representative of the individual for the protected health information of the individual1 the clearinghouse shall provide to the individual a comprehensive record of such information 7across health care providers and health plans and longitudinal in scope71 unless the clearinghouse determines in its sole discretion that providing a comprehensive record is not technologically feasible4 7#b7 ,purchase from other clearinghouses ,in preparing a comprehensive record for an individual under paragraph 7#a71 a health care clearinghouse may1 with the permission of the individual1 purchase the protected health information of the individual from one or more other health clearinghouses 7and the amount of such purchase may be included in a fee that is fair market value1 as defined in subsection 7j77#b71 charged to the individual4 7e7 ,situations not involving direct interaction with individuals ,sections #afd4djj through #afd4dad 7relating to breach notification7 and sections #afd4ebj through #afd4ebh 7relating to individual rights7 of title #de1 ,code of ,federal ,regulations1 shall apply to a health care clearinghouse that engages in the functions described in subsection 7b77#c7 to the extent that such clearinghouse has current contact information pursuant to direct interaction with the individual involved4 ,if the clearinghouse does not have direct interaction with the individual involved1 the clearinghouse shall provide notice of any breach of unsecured protected health information to the covered entity that does have direct interaction with the individual involved4 ,the clearinghouse shall not be required to report a breach if the protected health information is rendered unusable1 unreadable1 or indecipherable to unauthorized persons through the use of a technology or methodology specified by the ,secretary in the guidance issued under section #acdjb7;h77#b74 ,the clearinghouse shall also provide a notice of privacy practices on its website4 7f7 ,transition 7#a7 ,in general ,except where specifically stated1 nothing in this section shall be construed to apply to clearinghouses to the exclusion of other covered entities or to provide a health care clearinghouse greater authority to use and disclose protected health information than that provided to another covered entity4 7#b7 ,existing agreements ,with respect to agreements entered into by a health care clearinghouse prior to the date of enactment of this section1 a provision of such an agreement that conflicts with this section shall not have any legal force or effect4 ,the preceding sentence may not be construed as affecting any provision of an agreement that does not conflict with this section4 7g7 ,safe harbor and clarification of liability ,in the case of a health care clearinghouse that engages in a function described in subsection 7b71 only that clearinghouse may be held liable for a violation of a ,,hipaa-related provision 7and a covered entity that provided data or data access to the clearinghouse shall not be liable for such violations74 7h7 ,enforcement ,section #acdaj7;a77#b7 shall apply to this section in the same manner as such section applies to parts #a and #b4 7i7 ,relation to other laws 7#a7 ,application of ,,hitech rule ,section #acdba shall apply to this section in the same manner as such section applies to parts #a and #b1 except to the extent that such section #acdba concerns section #aagh7;a77#b77;,b7 of the ,social ,security ,act4 7#b7 ,state laws regarding unfair or deceptive acts or practices ,this part shall not be construed to preempt the law of any ,state that prohibits unfair or deceptive acts or practices or limit the authority of ,state attorneys general to enforce such laws4 7j7 ,definitions ,in this part3 7#a7 ,de-identified ,the term de-identified1 with respect to health information1 means such information that is not individually identifiable as determined in accordance with the standards under section #afd4ead7;b7 of title #de1 ,code of ,federal ,regulations4 7#b7 ,fair market value ,the term fair market value means the price that a person reasonably knowledgeable and interested in buying a given product or service would pay to a person reasonably knowledgeable and interested in selling the product or service4 7#c7 ,health care clearinghouse ,the term health care clearinghouse has the meaning given such term in section #aaga of the ,social ,security ,act4 7#d7 ,,hipaa-related provision ,the term ,,hipaa-related provision means the provisions of each of the following3 7,a7 ,this subtitle4 7,b7 ,part ,c of title ,,xi of the ,social ,security ,act4 7,c7 ,regulations promulgated pursuant to sections #bfb7;a7 and #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif or this subtitle4 7#e7 ,individual ,the term individual1 with respect to protected health information1 has the meaning applicable under section #afj4ajc of title #de1 ,code of ,federal ,regulations4 7#f7 ,qualifying data use agreement ,the term qualifying data use agreement means an agreement1 which may be electronic1 that-- 7,a7 establishes the permitted uses and disclosures of protected health information by the recipient2 7,b7 limits such uses and disclosures to the original purpose of disclosure under subsection 7b77#c77;,b72 and 7,c7 provides that the data recipient will-- 7i7 not use or further disclose the information other than as permitted by the qualifying data use agreement or as otherwise required by law2 7ii7 use appropriate safeguards to prevent use or disclosure of the information other than as provided for by the qualifying data use agreement2 and 7iii7 ensure that any agents to whom it provides the data agree to the same restrictions and conditions that apply to the data recipient with respect to such information4 4 7b7 ,regulations ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary of ,health and ,human ,services shall promulgate regulations to carry out the amendment made by subsection 7a74 7c7 ,conforming amendment ,section #aaga7b7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d7#b77 is amended by inserting before the period the following3 or receives a standard transaction from another entity and processes or facilitates the processing of health information into nonstandard format or nonstandard data content for the receiving entity4 ,such term also includes an entity that carries out such processing functions1 transmits standard health care claims1 transmits health care claim payments or provides advice on such1 and transmits any standard transactions on behalf of a ,,hipaa-covered entity and in addition1 engages in any authority of such entity described in subsection 7b77#c7 of section #acdea of the ,health ,information ,technology for ,economic and ,clinical ,health ,act4