De-identified information

(a) Establishment of standards Not later than 1 year after the date of enactment of this Act, the Secretary of Health and Human Services shall promulgate regulations establishing unified national standards for rendering applicable health information as de-identified information, in a manner similar to the manner in which individually identifiable health information may be rendered de-identified information pursuant to part 164 of title 45, Code of Federal Regulations (or any successor regulations). (b) Composition of standards Such standards shall— (1) be at least equivalent to or exceed the de-identification standard specified in section 164.514(b) of title 45, Code of Federal Regulations (or any successor regulations); (2) specify standards for the use of privacy-enhancing technologies as a method for creating de-identified information; and (3) specify that information shall not qualify as de-identified information when provided by a regulated entity, service provider, covered entity, or business associate to another person or entity unless such person or entity contractually agrees in writing not to re-identify or attempt to re-identify the information, and to require the same of any person or entity to whom such person or entity provides the information. (c) Definitions In this section— (1) the term applicable health information has the meaning given such term in section 2; (2) the terms business associate, covered entity, and individually identifiable health information have the meanings given such terms in section 160.103 of title 45, Code of Federal Regulations (or any successor regulations); and (3) the term privacy enhancing technologies means any software or hardware solution, technical process, or other technological means of mitigating individuals’ privacy risks arising from data processing by enhancing predictability, manageability, disassociability, and confidentiality.

(a) Establishment of standards Not later than 1 year after the date of enactment of this Act, the Secretary of Health and Human Services shall promulgate regulations establishing unified national standards for rendering applicable health information as de-identified information, in a manner similar to the manner in which individually identifiable health information may be rendered de-identified information pursuant to part 164 of title 45, Code of Federal Regulations (or any successor regulations). (b) Composition of standards Such standards shall— (1) be at least equivalent to or exceed the de-identification standard specified in section 164.514(b) of title 45, Code of Federal Regulations (or any successor regulations); (2) specify standards for the use of privacy-enhancing technologies as a method for creating de-identified information; and (3) specify that information shall not qualify as de-identified information when provided by a regulated entity, service provider, covered entity, or business associate to another person or entity unless such person or entity contractually agrees in writing not to re-identify or attempt to re-identify the information, and to require the same of any person or entity to whom such person or entity provides the information. (c) Definitions In this section— (1) the term applicable health information has the meaning given such term in section 2; (2) the terms business associate, covered entity, and individually identifiable health information have the meanings given such terms in section 160.103 of title 45, Code of Federal Regulations (or any successor regulations); and (3) the term privacy enhancing technologies means any software or hardware solution, technical process, or other technological means of mitigating individuals’ privacy risks arising from data processing by enhancing predictability, manageability, disassociability, and confidentiality.