,,ii ,calendar ,no4 #ech #aaith ,,congress #b;d ,session ,s4 #cjig ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,november #d1 #bjbe,mr4 ,cassidy introduced the following bill2 which was read twice and referred to the ,committee on ,health1 ,education1 ,labor1 and ,pensions ,august #d1 #bjbf,reported by ,mr4 ,cassidy1 with an amendment,strike out all after the enacting clause and insert the part printed in italic ,a ,,bill ,to provide additional protections with respect to health information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,health ,information ,privacy ,reform ,act4 #b4 ,protections for applicable health information 7a7 ,in general ,the ,secretary of ,health and ,human ,services1 in consultation with the ,federal ,trade ,commission1 shall promulgate regulations setting privacy1 security1 and breach notifications standards for the processing of applicable health information by regulated entities and their service providers4 ,such standards shall provide protections that are at least commensurate with1 and wherever feasible and appropriate harmonize with1 the protections provided through the privacy1 security1 and breach notification rules promulgated under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note7 and section #acdjb of the ,,hitech ,act 7#db ,u4,s4,c4 #agicb7 that apply to covered entities and business associates with respect to protected health information under such rules4 ,such regulations promulgated under this section shall include the following3 7#a7 ,privacy requirements1 including the following3 7,a7 ,permitted uses and disclosures of applicable health information without an individual's written authorization that are consistent with the individual's reasonable expectations4 7,b7 ,other permitted uses and disclosures of applicable health information without an individual's written authorization for certain public policy purposes1 such as public health1 health oversight1 law enforcement1 judicial and administrative proceedings1 and any conditions for such uses and disclosures4 7,c7 ,uses and disclosures of applicable health information that require the individual's written authorization and the requirements related to such written authorizations4 7,d7 ,prohibited uses and disclosures of applicable health information4 7,e7 ,minimum necessary requirements for the request1 use1 and disclosure of applicable health information and any exceptions4 7,f7 ,standards and requirements related to legal representatives of the individual4 7,g7 ,standards and requirements related to service providers4 7,h7 ,individual rights with respect to applicable health information1 including the right of the individual to receive a privacy notice from the regulated entity1 access to applicable health information1 amendment of applicable health information1 deletion of applicable health information1 and portability of applicable health information1 and any exceptions to such rights 7such as with respect to applicable health information collected for research purposes71 any conditions on such rights1 and any other requirements related to such rights1 including timeframes for responding to requests4 7,i7 ,administrative safeguards1 including designation of a privacy officer1 policies and procedures1 training of workforce members1 non-retaliation1 documentation1 and mitigation4 7#b7 ,security requirements1 including the following3 7,a7 ,physical1 technical1 and administrative safeguards for applicable health information in any form4 7,b7 ,for electronic applicable health information1 such safeguards shall be based on well-established national frameworks1 such as cybersecurity performance goals of the ,national ,institute of ,standards and ,technology or the ,department of ,health and ,human ,services4 7#c7 ,breach notification requirements in the event of a breach of applicable health information that are substantially similar to the breach notification requirements under subpart ,d of part #afd of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 7b7 ,enforcement authority ,the ,secretary1 in consultation with the ,federal ,trade ,commission1 is authorized to enforce all provisions of this ,act as described in subsection 7c74 7c7 ,civil penalties ,in addition to any other sanctions or remedies that may be available under any provision of ,federal law1 in the case of a regulated entity or service provider that violates this section1 subpart ,d of part #afj of title #de1 ,code of ,federal ,regulations 7or any successor regulations71 shall apply to the regulated entity or service provider with respect to such violation of this section in the same manner that such subpart applies to a person with respect to a violation of part #afj of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 7d7 ,extension of ,,hitech ,act amendment to regulated entities and service providers ,the privacy and security practices under section #acdab of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agida7 shall apply to regulated entities and service providers with respect to applicable health information in the same manner that such section applies to covered entities and business associates4 7e7 ,definitions ,in this section3 7#a7 ,applicable health information ,the term applicable health information-- 7,a7 means information 7including demographic information7 that-- 7i7 identifies an individual or with respect to which there is a reasonable basis to believe that the information could be used to identify an individual2 and 7ii7 relates to the past1 present1 or future physical or mental health or condition of an individual1 the provision of health care to an individual1 or the past1 present1 or future payment for the provision of health care to an individual2 and 7,b7 may include information described in subparagraph 7,a7 that was not created or received by a health care provider1 health plan1 employer1 or health care clearinghouse4 7#b7 ,covered entities2 business associates ,the terms covered entities and business associates have the meanings given such terms in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 7#c7 ,regulated entity ,the term regulated entity-- 7,a7 means a natural or legal person that1 alone or jointly with others1 determines the purpose and means of processing applicable health information2 and 7,b7 does not include-- 7i7 a governmental entity such as a body1 authority1 board1 bureau1 commission1 district1 agency1 or political subdivision of the ,federal1 ,state1 or local government2 7ii7 a person or an entity that is collecting1 processing1 or transferring covered data on behalf of or a ,federal1 ,state1 ,tribal1 territorial1 or local government entity2 and 7iii7 a covered entity or business associate1 as such terms are defined in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 7#d7 ,service provider ,the term service provider means a natural or legal entity that processes applicable health information on a behalf of a regulated entity and that is not a covered entity or business associate1 as such terms are defined in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 #c4 ,rights and requirements regarding access to certain protected health information 7a7 ,time and manner of access ,in applying section #acdje7;e7 of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agice7;e77 or section #afd4ebd7;c77#c77;ii7 of title #de1 ,code of ,federal ,regulations 7or any successor regulations71 in the case that an individual requests that a covered entity or any business associate of a covered entity transmit1 produce1 or provide access to a copy of the individual's protected health information to a person1 including an entity1 designated by the individual1 and except where permitted without authorization under section #afd4ejf7;c7 of title #de1 ,code of ,federal ,regulations 7or any successor regulations7-- 7#a7 the individual's request shall meet all requirements of a valid authorization under section #afd4ejh7;b7 of title #de1 ,code of ,federal ,regulations 7or any successor regulations72 and 7#b7 the covered entity or business associate may condition the transmittal1 production1 or provision of access upon the person to whom the information is to be transmitted or produced or to whom access is to be provided-- 7,a7 paying fees1 in accordance with applicable ,state law and consistent with subsection 7b71 in advance of such transmittal1 production1 or access2 and 7,b7 acknowledging and accepting the terms1 limitations1 and conditions of use and disclosure contained in the request made by the individual as the legally binding obligation of the person receiving the information4 7b7 ,fees 7#a7 ,in general ,in applying section #acdje7;e77#c7 of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agice7;e77#c77 or section #afd4ebd7;c77#d7 of title #de1 ,code of ,federal ,regulations 7or any successor regulations71 each such section shall apply only-- 7,a7 to the provision of access to1 or the production1 copying1 or transmittal of1 protected health information directly to-- 7i7 the individual1 or the individual's personal representative for health care purposes as described in section #afd4ejb7;g7 of title #de1 ,code of ,federal ,regulations 7or any successor regulations72 7ii7 subject to paragraph 7#b7 and section #afd4eaj7;b7 of title #de1 ,code of ,federal ,regulations 7or any successor regulation71 any other person identified in1 and subject to the limitations of1 such section2 or 7iii7 the individual's health care provider or the business associates of such provider2 and 7,b7 as directed by the individual1 to the electronic transmittal of the individual's electronic health record to the patient portal or mobile medical application used and maintained by the individual's health care provider or for the health care provider by its business associate4 7#b7 ,additional limitations ,in the case of the provision of access to1 or the production1 copying1 or transmittal of1 protected health information under paragraph 7#a77;,a7 directly to a person described in clause 7ii7 of such paragraph1 such protected health information shall1 in accordance with section #afd4eaj7;b7 of title #de1 ,code of ,federal ,regulations 7or any successor regulations71 be limited to only such information that is-- 7,a7 directly relevant to the person's involvement with the care of the individual or with the payment relevant to the care of the individual2 or 7,b7 needed for notification purposes described in such section4 7c7 ,definitions ,in this section1 the terms business associate1 covered entity1 health care provider1 individual1 person1 and protected health information have the meanings given such terms in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 7d7 ,guidance ,not later than #ahj days after the date of enactment of this ,act1 the ,secretary of ,health and ,human ,services shall amend existing guidance as necessary to implement subsections 7a7 and 7b74 #d4 ,confidentiality of records ,section #edc of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #bij;dd-#b7 is amended-- 7#a7 in subsection 7a71 by striking subsection 7b7 and inserting the ,,hipaa regulations2 7#b7 in subsection 7b7-- 7,a7 in paragraph 7#b71 by redesignating subparagraphs 7,a7 through 7,d7 as paragraphs 7#a7 through 7#d71 respectively1 and adjusting the margins accordingly2 and 7,b7 by striking 7b7 ,permitted disclosure and all that follows through 7#b7 ,method for disclosure--,whether and inserting the following3 7b7 ,permitted disclosure ,whether 2 7#c7 in subsection 7c71 in the matter preceding paragraph 7#a71 by striking subsection 7b77#b77;,c7 and inserting subsection 7b77#c72 and 7#d7 in subsection 7g71 by striking subsection 7b77#b77;,c7 and inserting subsection 7b77#c74 #e4 ,,nas study on compensation to patients for sharing identifiable data for research purposes 7a7 ,in general ,not later than #fj days after the date of enactment of this ,act1 the ,secretary of ,health and ,human ,services shall seek to enter into a contract with the ,national ,academies of ,sciences1 ,engineering1 and ,medicine to conduct a study examining potential risks and benefits of paying compensation to patients for sharing their identifiable data for research purposes4 7b7 ,inclusions ,the study conducted pursuant to the contract under subsection 7a7 shall include an examination of-- 7#a7 the risks to patient privacy posed by the integration of identifiable1 de-identified1 and aggregated health information into datasets used for research2 7#b7 privacy enhancing tools and methods for the protection of patient health data2 7#c7 the feasibility of tracking patient data and consent for the integration of patient health data into datasets used for research2 7#d7 ethical considerations for compensating patients for use of their identifiable and de-identified health data2 7#e7 whether the existing exemptions permitting de-identified data to be used for research should consider whether a patient was given an opportunity to opt-in or opt-out of participation2 and 7#f7 risk of re-identification of de-identified data4 #f4 ,patient notification requirements under the ,,hipaa privacy regulations 7a7 ,patient notification upon removal ,any regulated entity or service provider who gains access to the protected health information of an individual through the patient right of access under section #afd4ebd of title #de1 ,code of ,federal ,regulations 7or any successor regulations7 shall-- 7#a7 provide a written plain language notification to such individual prior to accessing such information-- 7,a7 that such protected health information will no longer be subject to the protections under the ,,hipaa privacy regulation2 and 7,b7 that includes an explanation of how and to which entities such protected health information may be redisclosed2 and 7#b7 require the consent of the individual before selling such protected health information to third parties4 7b7 ,patient notification regarding wellness data 7#a7 ,in general ,any regulated entity or service provider who offers digital technology that generates wellness data about individuals shall1 with respect to each individual who uses such technology-- 7,a7 provide a written plain language notification to the individual in advance of initiating the generation of such data that such data will not be subject to the protections of the ,,hipaa privacy regulation2 and 7,b7 offer the individual an opportunity to opt out of such wellness data generation4 7#b7 ,wellness data ,in this subsection1 the term wellness data means data generated for the purpose of promoting health or preventing disease1 which may include vital statistics1 step counts1 and medical regimen compliance4 7c7 ,definitions ,in this section-- 7#a7 the terms business associate1 covered entity1 and protected health information have the meanings given such terms in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or any successor regulations72 7#b7 the term ,,hipaa privacy regulation has the meaning given such term in section #aahj7;b77#c7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d-#i7;b77#c772 and 7#c7 the terms regulated entity and service provider have the meanings given such terms in section #b4 7d7 ,effective date ,this section shall take effect beginning one year after the date of enactment of this ,act4 #g4 ,minimum necessary guidance ,not later than #a year after the date of enactment of this ,act1 the ,secretary of ,health and ,human ,services shall publish guidance on the application of the minimum necessary standard to data used for artificial intelligence and other machine learning applications and relevant requirements1 including health data interoperability requirements under section #cjja7;c77#i7 of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #cjj;jj-#aa7;c77#i77 and the use of limited data sets pursuant to section #acdje7;b7 of the ,,hitech ,act 7#db ,u4,s4,c4 #agice7;b774 #h4 ,de-identified information 7a7 ,establishment of standards ,not later than #a year after the date of enactment of this ,act1 the ,secretary of ,health and ,human ,services shall promulgate regulations establishing unified national standards for rendering applicable health information as de-identified information1 in a manner similar to the manner in which individually identifiable health information may be rendered de-identified information pursuant to part #afd of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 7b7 ,composition of standards ,such standards shall-- 7#a7 be at least equivalent to or exceed the de-identification standard specified in section #afd4ead7;b7 of title #de1 ,code of ,federal ,regulations 7or any successor regulations72 7#b7 specify standards for the use of privacy-enhancing technologies as a method for creating de-identified information2 and 7#c7 specify that information shall not qualify as de-identified information when provided by a regulated entity1 service provider1 covered entity1 or business associate to another person or entity unless such person or entity contractually agrees in writing not to re-identify or attempt to re-identify the information1 and to require the same of any person or entity to whom such person or entity provides the information4 7c7 ,definitions ,in this section-- 7#a7 the term applicable health information has the meaning given such term in section #b2 7#b7 the terms business associate1 covered entity1 and individually identifiable health information have the meanings given such terms in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or any successor regulations72 and 7#c7 the term privacy enhancing technologies means any software or hardware solution1 technical process1 or other technological means of mitigating individuals' privacy risks arising from data processing by enhancing predictability1 manageability1 disassociability1 and confidentiality4 #i4 ,preemption ,section #afj4bjc of title #de1 ,code of ,federal ,regulations 7or any successor regulations7 shall apply to the requirements set forth under this ,act in the same manner and to the same extent as such section applies to the standards1 requirements1 and implementation specifications under subchapter ,c of chapter ,i of subtitle ,a of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 #a4 ,short title ,this ,act may be cited as the ,health ,information ,privacy ,reform ,act4 #b4 ,protections for applicable health information 7a7 ,in general ,not later than #ah months after the date of enactment of this ,act1 the ,secretary of ,health and ,human ,services 7referred to in this section as the ,secretary71 in consultation with the ,federal ,trade ,commission1 shall promulgate regulations establishing and implementing privacy1 security1 and breach notification standards for the processing of applicable health information by regulated entities and their service providers4 ,such standards shall provide rights and protections that are at least equivalent to1 and that1 wherever feasible and appropriate1 harmonize with1 the rights and protections provided through the privacy1 security1 and breach notification rules promulgated under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note7 and section #acdjb of the ,,hitech ,act 7#db ,u4,s4,c4 #agicb7 that apply to covered entities and business associates with respect to protected health information under such rules4 ,such regulations promulgated under this section shall include the following3 7#a7 ,privacy requirements1 including the following3 7,a7 ,permitted uses and disclosures of applicable health information without an individual's written authorization that are consistent with the individual's reasonable expectations1 taking into consideration the context in which the applicable health information was obtained1 provided that such regulations shall not authorize such a use or disclosure to investigate1 or to impose liability on1 any individual in connection with the seeking1 obtaining1 providing1 or facilitating of health care4 7,b7 ,uses and disclosures of applicable health information that require the individual's written authorization and the requirements related to such written authorizations1 including how the individual may revoke such authorization1 which shall include requiring the individual's written authorization for any sale1 licensing1 transfer1 or marketing of applicable health information4 7,c7 ,prohibited uses and disclosures of applicable health information4 7,d7 ,minimum necessary requirements for the request1 use1 and disclosure of applicable health information and any exceptions that are necessary for purpose specification1 collection limitation1 data minimization1 and limitation on secondary use and that are consistent with subsection 7b74 7,e7 ,standards and requirements for an individual to be authorized to exercise the rights granted in this section with respect to applicable health information of another individual4 7,f7 ,standards and requirements related to service providers4 7,g7 7i7 ,individual rights with respect to applicable health information1 including the following3 7,i7 ,the right of the individual to receive a privacy notice from the regulated entity1 which shall describe the purposes for which the regulated entity uses and discloses applicable health information1 the rights of the individual under this subparagraph1 and the manner in which such rights may be exercised4 7,,ii7 ,the right of access to applicable health information1 including the ability of the individual to direct the transmission of applicable health information held in an electronic health record to a third party4 7,,iii7 ,the right to amendment of applicable health information4 7,,iv7 ,the right to deletion of applicable health information1 not later than #cj days after the regulated entity or service provider receives a request for such a deletion1 and allowing for the regulated entity or service provider to communicate with the individual making such request prior to fulfilling such request4 7,v7 ,the right to portability of applicable health information1 including the ability of the individual to transfer such information between applications1 services1 or devices4 7ii7 ,any exception to1 or condition or other requirement on1 a right described in any of subclauses 7,i7 through 7,v7 of clause 7i71 including an exception with respect to applicable health information collected for research purposes and a timeframe for responding to a request of an individual for applicable health information4 7,h7 ,administrative safeguards1 including designation of a privacy officer1 policies and procedures1 training of workforce members1 non-retaliation1 documentation1 and mitigation4 7#b7 ,security requirements1 including the following3 7,a7 ,physical1 technical1 and administrative safeguards for applicable health information in written or oral form4 7,b7 ,the application of the standards under subpart ,c of part #afd of title #de1 ,code of ,federal ,regulations 7or any successor regulations7 to electronic applicable health information in the same manner as such standards apply to electronic protected health information4 7#c7 ,breach notification requirements in the event of a breach of applicable health information that are substantially similar to the breach notification requirements under subpart ,d of part #afd of title #de1 ,code of ,federal ,regulations 7or any successor regulations7 for applicable health information that is not subject to the health breach notification rule at part #cah of title #af1 ,code of ,federal ,regulations 7or any successor regulations74 7b7 ,requirements for regulated entities and service providers 7#a7 ,data minimization ,a regulated entity or service provider may not collect1 process1 or transfer applicable health information beyond what a covered entity is permitted to collect1 process1 or transfer under sections #afd4ejb7;b7 and #afd4ead7;d7 of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 7#b7 ,retention ,a regulated entity or service provider may not retain applicable health information for longer than is reasonably necessary to carry out the purpose for which such information was collected4 7#c7 ,exceptions ,paragraphs 7#a7 and 7#b7 shall not apply to the collection1 processing1 or transfer of applicable health information to the extent reasonably necessary for any of the following purposes3 7,a7 ,to complete a transaction or provide a product or service specifically requested by the individual to whom such information relates4 7,b7 ,to comply with a legal obligation1 or to establish1 exercise1 or defend a legal claim4 7,c7 ,to prevent1 detect1 or respond to a security incident1 fraud1 or harm to an individual4 7,d7 ,to carry out a public health activity permitted under the regulations promulgated under subsection 7a74 7,e7 ,to conduct research subject to part #df of title #de1 ,code of ,federal ,regulations1 or part #ej or #ef of title #ba1 ,code of ,federal ,regulations 7or any successor regulations74 7c7 ,enforcement 7#a7 ,coordination ,not later than #ahj days after the date of enactment of this ,act1 the ,secretary and the ,federal ,trade ,commission shall enter into a memorandum of understanding that allocates primary enforcement responsibility under this section1 provides for mutual notification of investigations into violations of this section1 and ensures that a regulated entity or service provider is not subject to duplicative civil penalties for the same act or omission4 7#b7 ,rule of construction ,nothing in this ,act shall be construed to limit or supersede the authority of the ,federal ,trade ,commission under section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de74 7#c7 ,civil penalties ,in addition to any other sanctions or remedies that may be available under any provision of ,federal law1 in the case of a regulated entity or service provider that violates this section1 subpart ,d of part #afj of title #de1 ,code of ,federal ,regulations 7or any successor regulations7 shall apply to the regulated entity or service provider with respect to such violation of this section in the same manner that such subpart applies to a person with respect to a violation of part #afj1 #afb1 or #afd of subchapter ,c of chapter ,i of subtitle ,a of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 ,any funds collected through civil penalties under this paragraph shall be used to support enforcement activity under this section4 7d7 ,extension of ,,hitech ,act amendment to regulated entities and service providers ,the privacy and security practices under section #acdab of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agida7 shall apply to regulated entities and service providers with respect to applicable health information in the same manner that such section applies to covered entities and business associates4 ,not later than #ah months after the date of enactment of this ,act1 the ,secretary shall promulgate regulations to carry out this subsection4 7e7 ,government access ,a regulated entity or service provider may not sell or otherwise transfer applicable health information to a ,federal1 ,state1 local1 ,tribal1 or territorial governmental entity except as compelled by warrant1 subpoena1 court order1 or other compulsory process4 7f7 ,definitions ,in this section3 7#a7 ,applicable health information ,the term applicable health information-- 7,a7 means information 7including demographic information7-- 7i7 that identifies an individual or with respect to which there is a reasonable basis to believe that the information could be used to identify an individual2 and 7ii7 that relates to the past1 present1 or future physical or mental health or condition of such individual1 the past1 present1 or future provision of health care to such individual1 or past1 present1 or future payment for the provision of health care to such individual2 7,b7 includes-- 7i7 information described in subparagraph 7,a7 that was not created or received by a health care provider1 health plan1 employer1 or health care clearinghouse2 and 7ii7 precise geolocation information that could reasonably indicate an attempt by an individual to acquire or receive a health service or supply2 and 7,c7 does not include-- 7i7 information subject to-- 7,i7 title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq472 7,,ii7 the requirements regarding the confidentiality of substance use disorder information under section #edc of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #bij;dd-#b72 7,,iii7 section #ddd of the ,general ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g2 commonly known as the ,family ,educational ,rights and ,privacy ,act of #aigd7 and part #ii of title #cd1 ,code of ,federal ,regulations 7or any successor regulations7 to the extent such regulated entity or service provider is an educational agency or institution as defined in such section of such ,act or section #ii4c of title #cd1 ,code of ,federal ,regulations 7or any successor regulations72 7,,iv7 provisions for the protection of identifiable private information that is collected pursuant to-- 7aa7 the ,federal requirements for the protection of human subjects under part #df of title #de1 ,code of ,federal ,regulations or part #ej or #ef of title #ba1 ,code of ,federal ,regulations 7or any successor regulations72 or 7bb7 the good clinical practice guidelines issued by the ,international ,council for ,harmonisation of ,technical ,requirements for ,pharmaceuticals for ,human ,use2 7,v7 the ,health ,care ,quality ,improvement ,act of #aihf 7#db ,u4,s4,c4 #aaaja et seq472 or 7,,vi7 part ,c of title ,,ix of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #bii;b-#ba et seq472 7ii7 publicly available information2 or 7iii7 information collected1 processed1 or transferred by an individual in the course of a purely personal or household activity4 7#b7 ,covered entities2 business associates ,the terms covered entities and business associates have the meanings given such terms in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 7#c7 ,data broker ,the term data broker means a regulated entity whose principal source of revenue is derived from processing or transferring applicable health information that the entity did not collect directly from the individuals to whom such information relates4 7#d7 ,regulated entity ,the term regulated entity-- 7,a7 means a natural or legal person1 including a data broker1 that1 alone or jointly with others1 determines the purpose and means of processing applicable health information2 and 7,b7 does not include-- 7i7 a covered entity or business associate1 with respect to protected health information2 or 7ii7 an individual who is the subject of the applicable health information or who obtains applicable health information in a personal or household capacity4 7#e7 ,service provider ,the term service provider means a natural or legal entity that processes applicable health information on behalf of a regulated entity and that is not a covered entity or business associate4 7g7 ,regulations ,the ,secretary may promulgate regulations to carry out this section4 #c4 ,rights and requirements regarding access to certain protected health information 7a7 ,time and manner of access ,in applying section #acdje7;e7 of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agice7;e77 or section #afd4ebd7;c77#c77;ii7 of title #de1 ,code of ,federal ,regulations 7or any successor regulations71 in the case that an individual requests that a covered entity or any business associate of a covered entity transmit1 produce1 or provide access to a copy of the individual's protected health information in an electronic health record to a person designated by the individual1 the covered entity or business associate may condition the transmittal1 production1 or provision of access upon the person to whom the information is to be transmitted or produced or to whom access is to be provided-- 7#a7 paying fees1 in accordance with applicable ,state law and consistent with subsection 7b71 in advance of such transmittal1 production1 or access2 and 7#b7 acknowledging and accepting the terms1 limitations1 and conditions of use and disclosure contained in the request made by the individual as the legally binding obligation of the person receiving the information4 7b7 ,fees ,in applying section #acdje7;e77#c7 of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agice7;e77#c77 or section #afd4ebd7;c77#d7 of title #de1 ,code of ,federal ,regulations 7or any successor regulations71 each such section shall apply only to the provision of access to1 or the production1 copying1 or transmittal of1 protected health information to-- 7#a7 the individual1 or the individual's personal representative2 7#b7 the individual's health care provider or the business associates of such provider2 or 7#c7 a personal health record managed and controlled by the individual4 7c7 ,definitions ,in this section-- 7#a7 the terms business associate1 covered entity1 health care provider1 individual1 person1 and protected health information have the meanings given such terms in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or any successor regulations72 and 7#b7 the term personal health record has the meaning given such term in section #acdjj of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agiba74 7d7 ,guidance ,not later than #ahj days after the date of enactment of this ,act1 the ,secretary of ,health and ,human ,services shall amend existing guidance as necessary to implement subsections 7a7 and 7b74 7e7 ,rules of construction ,nothing in this section shall be construed to-- 7#a7 permit a covered entity or business associate to deny1 delay1 or condition a transmission directed by an individual in a manner that constitutes information blocking under section #cjbb of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #cjj;jj-#eb7 or part #aga of title #de1 ,code of ,federal ,regulations 7or any successor regulations72 7#b7 treat an individual or the individual's personal representative who receives or accesses the individual's protected health information on the individual's behalf and at the direction of the individual as a person to whom a fee or condition may be applied under subsection 7a71 with respect to a personal health record that is selected1 managed1 and controlled by the individual or the individual's personal representative2 or 7#c7 alter the rights or responsibilities of covered entities and individuals under section #acdje7;e7 of the ,,hitech ,act 7#db ,u4,s4,c4 #agice74 #d4 ,minimum necessary guidance 7a7 ,rulemaking ,not later than #a year after the date of enactment of this ,act1 the ,secretary of ,health and ,human ,services 7referred to in this section as the ,secretary71 in coordination with the ,commissioner of ,food and ,drugs and the ,national ,coordinator for ,health ,information ,technology1 shall promulgate regulations regarding the application of the minimum necessary standard under section #afd4ejb7;b7 of title #de1 ,code of ,federal ,regulations1 to applicable health information and protected health information1 including such information used to train1 develop1 validate1 modify1 or operate an artificial intelligence or other machine learning model4 7b7 ,contents ,the regulations promulgated under subsection 7a7 shall-- 7#a7 clarify that such minimum necessary standard does not permit a covered entity1 business associate1 regulated entity1 or service provider to deny1 delay1 or condition a use or disclosure that is otherwise required or permitted1 including a disclosure required under section #cjbb of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #cjj;jj-#eb71 on the ground that limiting the disclosure to the minimum necessary information is not technically feasible1 and1 as applicable1 the minimum necessary standard is satisfied by reasonable efforts to limit the information used or disclosed1 even where further technical limitation is not feasible2 7#b7 specify how the minimum necessary standard applies to the use of applicable health information and protected health information to develop1 train1 validate1 or fine-tune an artificial intelligence or machine learning model1 including the circumstances under which the use of a larger data set is reasonably necessary for such development1 and the extent to which de-identification1 data minimization1 or privacy-enhancing technologies satisfy the standard2 and 7#c7 address the minimum necessary standard with respect to the health data interoperability requirements under sections #cjja7;c77#i7 and #cjbb of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #cjj;jj-#aa7;c77#i71 #cjj;jj-#eb7 and part #aga of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 7c7 ,periodic review ,the ,secretary shall review1 and update as appropriate1 the regulations promulgated under subsection 7a7 not less frequently than once every #c years4 #e4 ,de-identified information 7a7 ,establishment of standards ,not later than #a year after the date of enactment of this ,act1 the ,secretary of ,health and ,human ,services shall promulgate regulations establishing unified national standards for rendering applicable health information as de-identified information1 in a manner similar to the manner in which individually identifiable health information may be rendered de-identified information pursuant to part #afd of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 7b7 ,composition of standards ,the standards under subsection 7a7 shall-- 7#a7 be at least as protective as the de-identification standard specified in section #afd4ead7;b77#a7 of title #de1 ,code of ,federal ,regulations 7or any successor regulations7 7relating to expert determination71 and may not permit information to be rendered de-identified information solely through the method specified in section #afd4ead7;b77#b7 of such title 7relating to safe harbor72 7#b7 specify standards for the use of privacy-enhancing technologies as a method for creating de-identified information2 7#c7 specify that information shall not qualify as de-identified information when provided by a regulated entity1 service provider1 covered entity1 or business associate to another person or entity unless such person or entity contractually agrees in writing not to re-identify or attempt to re-identify the information1 and to require the same of any person or entity to whom such person or entity provides the information2 and 7#d7 account for evolving methods of re-identification1 including methods that use artificial intelligence or machine learning4 7c7 ,prohibition on re-identification ,an entity that is the recipient of de-identified information may not re-identify1 or attempt to re-identify1 such information4 ,a violation of this subsection shall be enforceable and subject to the civil penalties under section #b7;c74 7d7 ,definitions ,in this section-- 7#a7 the term applicable health information has the meaning given such term in section #b2 7#b7 the terms business associate1 covered entity1 and individually identifiable health information have the meanings given such terms in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or any successor regulations72 and 7#c7 the term privacy-enhancing technologies means any software or hardware solution1 technical process1 or other technological means of mitigating individuals' privacy risks arising from data processing by enhancing predictability1 manageability1 disassociability1 and confidentiality4 #f4 ,preemption ,section #afj4bjc of title #de1 ,code of ,federal ,regulations 7or any successor regulations7 shall apply to the requirements set forth under this ,act in the same manner and to the same extent as such section applies to the standards1 requirements1 and implementation specifications under subchapter ,c of chapter ,i of subtitle ,a of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 ,august #d1 #bjbf,reported with an amendment