,i #aaith ,,congress #ast ,session ,h4 ,r4 #ddgj ,,in ,,the ,,house ,,of ,,representatives ,july #af1 #bjbe,ms4 ,van ,duyne 7for herself1 ,ms4 ,del,bene1 ,mrs4 ,miller of ,west ,virginia1 and ,mr4 ,costa7 introduced the following bill2 which was referred to the ,committee on ,ways and ,means1 and in addition to the ,committee on ,energy and ,commerce1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,a ,,bill ,to amend title ,,xi of the ,social ,security ,act to require hospitals participating in the ,medicare and ,medicaid programs to establish certain notification procedures with respect to organ procurement agencies4 #a4 ,short title ,this ,act may be cited as the ,removing ,burdens ,from ,organ ,donation ,act4 #b4 ,notifying organ procurement agencies with respect to potential organ donors 7a7 ,in general ,section #aach7;a7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;b-#h7;a77 is amended-- 7#a7 in paragraph 7#a77;,a77iii7-- 7,a7 by adding and at the end2 7,b7 by striking that such and inserting that-- 7,i7 such 2 and 7,c7 by adding at the end the following new subclause3 7,,ii7 subject to paragraph 7#d71 beginning on the date that is #b years after the date of the enactment of the ,removing ,burdens ,from ,organ ,donation ,act1 with respect to such a potential organ donor1 such hospital's designated organ procurement agency is issued an automated electronic notification and is provided electronic and remote access to the electronic health records of such potential organ donor when such electronic health records are updated to indicate that such potential organ donor is deceased or that the death of such potential organ donor is imminent1 as determined in accordance with the protocol described in section #dhb4de7;a77#a7 of title #db1 ,code of ,federal ,regulations 7or any successor regulation72 2 and 7#b7 by adding at the end the following new paragraph3 7#d7 ,exemptions from automated ,,ehr access requirement 7,a7 ,exemptions 7i7 ,in general ,the ,secretary may exempt a hospital or critical access hospital from the automated electronic notification and remote access requirement under paragraph 7#a77;,a77iii77,,ii7 for a period of #c years if the ,secretary determines that meeting such requirement would result in a significant hardship1 such as in the case of a hospital or critical access hospital located in a rural area without sufficient ,internet access1 or other exceptional circumstances demonstrated by the hospital4 7ii7 ,automatic exemption ,the ,secretary shall grant an exemption described in clause 7i7 to a hospital or critical access hospital for a period of #a year if the ,secretary determines that such hospital is affected by a cybersecurity attack 7as defined in subparagraph 7,c771 or is located in an area affected by a major disaster 7as defined in section #eabb7b7 of title #db1 ,united ,states ,code7 or any other natural or man-made disaster1 and shall notify such hospital or critical access hospital of such exemption4 7iii7 ,extension ,the ,secretary may extend an exemption granted under clause 7i7 or 7ii7 if the hospital or critical access hospital demonstrates to the satisfaction of the ,secretary that such an extension is necessary4 7,b7 ,report ,not later than #b years after the date of the enactment of the ,removing ,burdens ,from ,organ ,donation ,act1 and not less frequently than annually thereafter1 the ,secretary shall submit to the ,committee on ,ways and ,means and the ,committee on ,energy and ,commerce of the ,house of ,representatives1 and to the ,committee on ,finance and the ,committee on ,health1 ,education1 ,labor1 and ,pensions of the ,senate1 a report on the number of exemptions granted under subparagraph 7,a7 during the previous year and the reason for granting each such exemption4 7,c7 ,cybersecurity attack defined ,for purposes of subparagraph 7,a71 the term cybersecurity attack means1 with respect to a hospital or a critical access hospital1 any kind of malicious activity that-- 7i7 attempts to collect1 modify1 disrupt1 deny1 degrade1 or destroy information system resources of the hospital1 including the information itself2 7ii7 affects the confidentiality1 integrity or availability of data1 information1 or operational technology system resources of the hospital2 or 7iii7 poses any other threat to the information1 information systems1 technology1 or technological capabilities of the hospital1 as determined by the ,secretary4 4 7b7 ,guidance on best practices 7#a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 the ,secretary of ,health and ,human ,services shall issue guidance to hospitals1 critical access hospitals1 organ procurement agencies1 and electronic health record companies regarding best practices for complying with the automated electronic notification and remote access requirement under subclause 7,,ii7 of section #aach7;a77#a77;,a77iii7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;b-#h7;a77#a77;,a77iii771 as added by subsection 7a74 ,such guidance shall be based upon the experiences of entities that have previous experience with the implementation of similar automated electronic notifications and remote access1 and shall provide insights on what worked well and what did not4 7#b7 ,explanation of changes to donors and family members ,not later than #a year after the date of the enactment of this ,act1 the ,secretary of ,health and ,human ,services shall issue guidance to ,state health agencies 7or such other ,state agency1 department1 or authority as the ,governor of each ,state may determine appropriate7 regarding best practices for explaining the automated electronic notification and remote access requirement under subclause 7,,ii7 of section #aach7;a77#a77;,a77iii7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;b-#h7;a77#a77;,a77iii771 as added by subsection 7a71 to organ donors1 potential organ donors1 and the family members of such donors and potential donors4 7c7 ,,gao report and study ,the ,comptroller ,general of the ,united ,states 7in this subsection referred to as the ,comptroller ,general7 shall-- 7#a7 carry out a study on the implementation of the automated electronic notification and remote access requirement under subclause 7,,ii7 of section #aach7;a77#a77;,a77iii7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;b-#h7;a77#a77;,a77iii771 as added by subsection 7a71 that takes into account-- 7,a7 the cost of implementing the automated electronic notification and remote access requirement described in such paragraph2 7,b7 the impact of hospital location on the implementation of such requirement1 including the impact of limited broadband access in rural areas1 and improvements that could be made to facilitate such implementation2 and 7,c7 the reports submitted by the ,secretary pursuant to paragraph 7#d77;,b7 of section #aach7;a7 of such ,act 7#db ,u4,s4,c4 #acbj;b-#h7;a771 as added by subsection 7a72 and 7#b7 not later than #c years after the date of the enactment of the ,removing ,burdens from ,organ ,donation ,act1 submit to ,congress a report on the results of the study carried out under paragraph 7#a7 that includes-- 7,a7 an analysis of data maintained by the ,department of ,health and ,human ,services related to the outcomes of organ transplants performed after the enactment of the ,removing ,burdens from ,organ ,donation ,act2 7,b7 a review of issues related to securing patient data and the roles of the ,centers for ,medicare ,medicaid ,services and the ,health ,resources and ,services ,administration with respect to those issues2 and 7,c7 any recommendations for further action1 as appropriate4