§300jj–19 Miscellaneous provisions

Summary

Requires health IT rules to work with HIPAA privacy and security law and does not change the Secretary’s existing HIPAA powers. The law says the health IT standards and how they are used (including under section 300jj–14) must consider HIPAA privacy and security rules. The phrase “HIPAA privacy and security law” means part C of title XI of the Social Security Act (42 U.S.C. 1320d et seq.), section 264 of the Health Insurance Portability and Accountability Act of 1996, subtitle D of title IV of the HITECH Act, and the regulations under them. Gives the Secretary flexibility to treat the term “health care provider” (see section 300jj(3)) differently when needed. Directs the Secretary to use existing powers to encourage partnerships between health information exchanges/networks and providers, health plans, and others so patients can get their electronic health information in one easy-to-understand, secure, and automatically updated record. The Secretary and the Office for Civil Rights (OCR) must teach providers how to use exchanges, clear up misunderstandings, and steer providers to exchanges that have the needed features. They must issue best-practice guidance so shared records are private, secure, accurate, and verifiable, and so records that need patient permission can be easily shared under that permission. State laws that give stronger patient consent protections still apply. The National Coordinator and OCR must promote convenient patient access without burdening providers. For certification (see section 300jj–11(c)(5)), the National Coordinator may require support for single-record patient access, electronic patient-reported information, and patient-controlled research access, and ask the HIT Advisory Committee to set standards to help these goals.