§17921 Definitions

Summary

Defines important words used in this part of the law. It calls a "breach" when protected health information is gotten, seen, used, or shared without permission in a way that hurts its privacy or security. It is not a breach if the person who got the information could not reasonably keep it, or if the access was an accidental, good-faith action by an employee within their job and the information was not further shared, or if it was an inadvertent sharing between authorized staff at the same facility and not further misused. Also defines other terms in one line each. Business associate — as defined in 45 CFR 160.103. Covered entity — as defined in 45 CFR 160.103. Disclose/disclosure — as in 45 CFR 160.103. Electronic health record — an electronic record created and used by authorized clinicians and staff. Health care operations — as in 45 CFR 164.501. Health care provider — as in 45 CFR 160.103. Health plan — as in 45 CFR 160.103. National Coordinator — the head of the Office of the National Coordinator for Health IT (established under section 300jj–11(a)). Payment — as in 45 CFR 164.501. Personal health record — an electronic PHR-identifiable record drawn from many sources and managed or controlled by the individual (see 17937(f)(2)). Protected health information — as in 45 CFR 160.103. Secretary — the Secretary of Health and Human Services. Security — as in 45 CFR 164.304. State — each State, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands. Treatment — as in 45 CFR 164.501. Use — as in 45 CFR 160.103. Vendor of personal health records — any entity, other than a covered entity, that offers or maintains a personal health record.