123STA T . 2 6 6 PUBLIC LA W 111 –5—FE B.1 7, 2 0 0 930 0 2(b) (2)( B )( iv ) ofthePu b l i cH e a lth S e r vice A ct , a s a d ded b y sectio n1 3101 . Such re g ulations shall only re q uire such infor m ation to be collected through an electronic health record in a manner that ta k es into account the interests of the individ - uals in learning the circumstances under w hich their p rotected health information is being disclosed and takes into account the administrative burden of accounting for such disclosures. ‘ ‘(3) P ROCES S. —I n response to an request from an individual for an accounting, a covered entity shall elect to provide either an— ‘‘(A) accounting, as specified under paragraph (1), for disclosures of protected health information that are made by such covered entity and by a business associate acting on behalf of the covered entity
or ‘‘(B) accounting, as specified under paragraph (1), for disclosures that are made by such covered entity and pro- vide a list of all business associates acting on behalf of the covered entity, including contact information for such associates (such as mailing address, phone, and email address). A business associate included on a list under subparagraph (B) shall provide an accounting of disclosures (as required under paragraph (1) for a covered entity) made by the business asso- ciate upon a request made by an individual directly to the business associate for such an accounting. ‘‘( 4 ) EF FEC TIV E DA TE.— ‘‘(A) CU RRE N TUSERSOFE L ECTRONIC RECORDS.—In the case of a covered entity insofar as it acquired an electronic health record as of J anuary 1, 200 9 , paragraph (1) shall apply to disclosures, with respect to protected health information, made by the covered entity from such a record on and after January 1, 2014. ‘‘(B) O T H ERS.—In the case of a covered entity insofar as it acquires an electronic health record after January 1, 2009, paragraph (1) shall apply to disclosures, with respect to protected health information, made by the cov- ered entity from such record on and after the later of the following
‘‘(i) January 1, 2011; or ‘‘(ii) the date that it acquires an electronic health record. ‘‘(C) L ATER DATE.— T he Secretary may set an effective date that is later that the date specified under subpara- graph (A) or (B) if the Secretary determines that such later date is necessary, but in no case may the date speci- fied under— ‘‘(i) subparagraph (A) be later than 201 6
- or
‘‘(ii) subparagraph (B) be later than 2013. ’ ’ (d) PROHI B ITION ON SALE OF ELECTRONIC HEALTH R ECORDS OR PROTECTED HEALTH INFOR M ATION.— (1) IN G ENERAL.—E x cept as provided in paragraph (2), a covered entity or business associate shall not directly or indirectly receive remuneration in exchange for any protected health information of an individual unless the covered entity obtained from the individual, in accordance with section 164. 5 0 8 of title 45, Code of F ederal Regulations, a valid authori z ation that includes, in accordance with such section, a specification Ap p licab ili ty.
