123STA T . 2 78PUBLIC LA W 111 –5—FE B. 17 , 2 0 0 9(i i )ent itie s t ha t of fe rp ro duc ts or ser v ices throu g h the w e b site of a vendor of persona l health records
(iii) entities that are not covered entities and that offer products or services through the websites of cov - ered entities that offer individuals personal health records; (iv) entities that are not covered entities and that access infor m ation in a personal health record or send information to a personal health record; and (v) third part y service providers used by a vendor or entity described in clause (i) , (ii), (iii), or (iv) to assist in providing personal health record products or services; ( B ) a determination of which F ederal government agency is best e q uipped to enforce such requirements rec- ommended to be applied to such vendors, entities, and service providers under subparagraph ( A ); and ( C ) a timeframe for implementing regulations based on such findings . ( 2 ) REPORT . —T he S ecretary shall submit to the Committee on Finance, the Committee on H ealth, E ducation, L abor, and P ensions, and the Committee on Commerce of the Senate and the Committee on W ays and M eans and the Committee on Energy and Commerce of the House of Representatives a report on the findings of the study under paragraph ( 1 ) and shall include in such report recommendations on the privacy and security requirements described in such paragraph. (c) GUIDANC EON IM P L EMENTATION SPECI F ICATION TO D E-IDEN- TIF Y PROTECTED HEALT H INFORMATION.— N ot later than 12 months after the date of the enactment of this title, the Secretary shall, in consultation with sta k eholders, issue guidance on how best to implement the requirements for the de-identification of protected health information under section 1 64 . 5 14(b) of title 45, Code of Federal Regulations. (d) GA O REPORT ON TREATMENT DI S CLOSURES.—Not later than one year after the date of the enactment of this title, the Comptroller General of the U nited States shall submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Ways and Means and the Committee on Energy and Commerce of the House of Representatives a report on the best practices related to the disclosure among health care providers of protected health information of an individual for purposes of treatment of such individual. Such report shall include an e x amina- tion of the best practices implemented by States and by other entities, such as health information exchanges and regional health information organi z ations, an examination of the extent to which such best practices are successful with respect to the quality of the resulting health care provided to the individual and with respect to the ability of the health care provider to manage such best practices, and an examination of the use of electronic informed consent for disclosing protected health information for treatment, payment, and health care operations. (e) REPORT RE Q UIRED.—Not later than 5 years after the date of enactment of this section, the Government Accountability Office shall submit to Congress and the Secretary of Health and Human Services a report on the impact of any of the provisions of this
