123STA T . 2 65PUBLIC LA W 111 – 5 —FE B.1 7, 2 0 0 9section164.502(b) (1) o f tit l e45 ,C o d eof F ede ra l R e gu la - tions, w it h res p ect to the use, disclosure, or re q uest of protected health infor m ation described in such section, onl y if the co v ered entity limits such protected health informa- tion, to the e x tent practicable, to the limited data set (as defined in section 164.514(e)(2) of such title) or, if needed by such entity, to the minimum necessary to accom- plish the intended purpose of such use, disclosure, or request, respectively. ( B ) GUIDANCE . —N ot later than 1 8 months after the date of the enactment of this section, the S ecretary shall issue guidance on what constitutes ‘ ‘minimum necessary ’ ’ for purposes of subpart E of part 164 of title 45, Code of Federal Regulation. I n issuing such guidance the Sec- retary shall ta k e into consideration the guidance under section 1 3 424(c) and the information necessary to improve patient outcomes and to detect, prevent, and manage chronic disease. (C) SUN S E T .—Subparagraph ( A ) shall not apply on and after the effective date on which the Secretary issues the guidance under subparagraph (B). (2) D ETE RM INATI O NO F MINIMUM NECESSAR Y .—For purposes of paragraph (1), in the case of the disclosure of protected health information, the covered entity or business associate disclosing such information shall determine what constitutes the minimum necessary to accomplish the intended purpose of such disclosure. (3) A P P L ICATION OF E X CEPTIONS.— T he exceptions described in section 164.502(b)(2) of title 45, Code of Federal Regulations, shall apply to the requirement under paragraph (1) as of the effective date described in section 13423 in the same manner that such exceptions apply to section 164.502(b)(1) of such title before such date. (4) RULE OF CONSTRUCTION.—Nothing in this subsection shall be construed as affecting the use, disclosure, or request of protected health information that has been de-identified. (c) ACCOUNTIN G OF CERTAIN P ROTECTED H EALT H INFORMATION DISCLOSURES RE Q UIRED IF CO V ERED ENTITY U SES ELECTRONIC HEALTH RECORD.— ‘‘(1) IN GENERAL.—In applying section 164.528 of title 45, Code of Federal Regulations, in the case that a covered entity uses or maintains an electronic health record with respect to protected health information— ‘‘(A) the exception under paragraph (a)(1)(i) of such section shall not apply to disclosures through an electronic health record made by such entity of such information
and ‘‘(B) an individual shall have a right to receive an accounting of disclosures described in such paragraph of such information made by such covered entity during only the three years prior to the date on which the accounting is requested. ‘‘(2) REGULATIONS.—The Secretary shall promulgate regula- tions on what information shall be collected about each disclo- sure referred to in paragraph (1), not later than 6 months after the date on which the Secretary adopts standards on accounting for disclosure described in the section Deadlin e . Deadline.
