H.R. 2549

This bill amends the HITECH Act to require the Department of Health and Human Services (HHS) to revise or clarify the privacy rule established under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to allow the use and disclosure of protected health information for research purposes without the individual's authorization, approval from an Institutional Review Board or Privacy Board, or representations from the researcher regarding limited use of the information.

These disclosures may only be made to entities subject to HIPAA for health care operations or to business associates that are complying with the privacy rule for health care operations or data aggregation.

There is no limitation on payments for these disclosures. Currently, payment is limited to the cost to prepare and transmit the information.

An individual's protected health information may be disclosed without the authorization or agreement of the individual for research related to a product or activity that is regulated by the Food and Drug Administration.

A researcher is allowed remote access to protected health information if security and privacy safeguards are maintained and the researcher does not retain the information.

An individual's authorization to use protected health information for future research is sufficient for a research purpose if the authorization reasonably describes the research and provides instruction to the individual on how to revoke the authorization.