{"identifier":"/us/usc/t42/s17921","title":42,"num":"\u00a7\u202f17921.","heading":"Definitions","text":"\u00a7\u202f17921.\nDefinitions\nIn this subchapter, except as specified otherwise:\n(1)\nBreach\n(A)\nIn general\nThe term \u201cbreach\u201d means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.\n(B)\nExceptions\nThe term \u201cbreach\u201d does not include\u2014\n(i) any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if\u2014\n(I) such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate; and\n(II) such information is not further acquired, accessed, used, or disclosed by any person; or\n(ii) any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at\n1\n1 So in original. Probably should be followed by \u201cthe\u201d.\n(iii) any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person.\n(2)\nBusiness associate\nThe term \u201cbusiness associate\u201d has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.\n(3)\nCovered entity\nThe term \u201ccovered entity\u201d has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.\n(4)\nDisclose\nThe terms \u201cdisclose\u201d and \u201cdisclosure\u201d have the meaning given the term \u201cdisclosure\u201d in section 160.103 of title 45, Code of Federal Regulations.\n(5)\nElectronic health record\nThe term \u201celectronic health record\u201d means an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff.\n(6)\nHealth care operations\nThe term \u201chealth care operation\u201d has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations.\n(7)\nHealth care provider\nThe term \u201chealth care provider\u201d has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.\n(8)\nHealth plan\nThe term \u201chealth plan\u201d has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.\n(9)\nNational Coordinator\nThe term \u201cNational Coordinator\u201d means the head of the Office of the National Coordinator for Health Information Technology established under\nsection 300jj\u201311(a) of this title\n2\n2 See References in Text note below.\n(10)\nPayment\nThe term \u201cpayment\u201d has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations.\n(11)\nPersonal health record\nThe term \u201cpersonal health record\u201d means an electronic record of PHR identifiable health information (as defined in\nsection 17937(f)(2) of this title\n(12)\nProtected health information\nThe term \u201cprotected health information\u201d has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.\n(13)\nSecretary\nThe term \u201cSecretary\u201d means the Secretary of Health and Human Services.\n(14)\nSecurity\nThe term \u201csecurity\u201d has the meaning given such term in section 164.304 of title 45, Code of Federal Regulations.\n(15)\nState\nThe term \u201cState\u201d means each of the several States, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands.\n(16)\nTreatment\nThe term \u201ctreatment\u201d has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations.\n(17)\nUse\nThe term \u201cuse\u201d has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.\n(18)\nVendor of personal health records\nThe term \u201cvendor of personal health records\u201d means an entity, other than a covered entity (as defined in paragraph (3)), that offers or maintains a personal health record.","url":"https://projectusc.org/usc/t42/s17921.html","content":[{"t":"sec","id":"/us/usc/t42/s17921","children":[{"t":"num","text":"\u00a7\u202f17921."},{"t":"heading","text":"Definitions","tail":"\n"},{"t":"chapeau","text":"In this subchapter, except as specified otherwise:"},{"t":"para","id":"/us/usc/t42/s17921/1","children":[{"t":"num","text":"(1)"},{"t":"heading","text":"Breach"},{"t":"subpara","id":"/us/usc/t42/s17921/1/A","children":[{"t":"num","text":"(A)"},{"t":"heading","text":"In general"},{"t":"content","children":[{"t":"p","text":"The term \u201cbreach\u201d means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"subpara","id":"/us/usc/t42/s17921/1/B","children":[{"t":"num","text":"(B)"},{"t":"heading","text":"Exceptions"},{"t":"chapeau","text":"The term \u201cbreach\u201d does not include\u2014"},{"t":"clause","id":"/us/usc/t42/s17921/1/B/i","children":[{"t":"num","text":"(i)"},{"t":"chapeau","text":" any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if\u2014"},{"t":"subclause","id":"/us/usc/t42/s17921/1/B/i/I","children":[{"t":"num","text":"(I)"},{"t":"content","text":" such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate; and","tail":"\n"}],"tail":"\n"},{"t":"subclause","id":"/us/usc/t42/s17921/1/B/i/II","children":[{"t":"num","text":"(II)"},{"t":"content","text":" such information is not further acquired, accessed, used, or disclosed by any person; or","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"clause","id":"/us/usc/t42/s17921/1/B/ii","children":[{"t":"num","text":"(ii)"},{"t":"content","text":" any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at\u202f","children":[{"t":"ref","text":"1"},{"t":"num","text":"1","tail":"\u202fSo in original. Probably should be followed by \u201cthe\u201d."},{"t":"text","text":"\u202fSo in original. Probably should be followed by \u201cthe\u201d.","tail":" same facility; and"}],"tail":"\n"}],"tail":"\n"},{"t":"clause","id":"/us/usc/t42/s17921/1/B/iii","children":[{"t":"num","text":"(iii)"},{"t":"content","text":" any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person.","tail":"\n"}],"tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/2","children":[{"t":"num","text":"(2)"},{"t":"heading","text":"Business associate"},{"t":"content","children":[{"t":"p","text":"The term \u201cbusiness associate\u201d has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/3","children":[{"t":"num","text":"(3)"},{"t":"heading","text":"Covered entity"},{"t":"content","children":[{"t":"p","text":"The term \u201ccovered entity\u201d has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/4","children":[{"t":"num","text":"(4)"},{"t":"heading","text":"Disclose"},{"t":"content","children":[{"t":"p","text":"The terms \u201cdisclose\u201d and \u201cdisclosure\u201d have the meaning given the term \u201cdisclosure\u201d in section 160.103 of title 45, Code of Federal Regulations.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/5","children":[{"t":"num","text":"(5)"},{"t":"heading","text":"Electronic health record"},{"t":"content","children":[{"t":"p","text":"The term \u201celectronic health record\u201d means an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/6","children":[{"t":"num","text":"(6)"},{"t":"heading","text":"Health care operations"},{"t":"content","children":[{"t":"p","text":"The term \u201chealth care operation\u201d has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/7","children":[{"t":"num","text":"(7)"},{"t":"heading","text":"Health care provider"},{"t":"content","children":[{"t":"p","text":"The term \u201chealth care provider\u201d has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/8","children":[{"t":"num","text":"(8)"},{"t":"heading","text":"Health plan"},{"t":"content","children":[{"t":"p","text":"The term \u201chealth plan\u201d has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/9","children":[{"t":"num","text":"(9)"},{"t":"heading","text":"National Coordinator"},{"t":"content","children":[{"t":"p","text":"The term \u201cNational Coordinator\u201d means the head of the Office of the National Coordinator for Health Information Technology established under ","children":[{"t":"ref","text":"section 300jj\u201311(a) of this title","href":"/us/usc/t42/s300jj\u201311/a","tail":", as added by section 13101."},{"t":"ref","text":"2"},{"t":"num","text":"2","tail":"\u202fSee References in Text note below."},{"t":"text","text":"\u202fSee References in Text note below."}],"tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/10","children":[{"t":"num","text":"(10)"},{"t":"heading","text":"Payment"},{"t":"content","children":[{"t":"p","text":"The term \u201cpayment\u201d has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/11","children":[{"t":"num","text":"(11)"},{"t":"heading","text":"Personal health record"},{"t":"content","children":[{"t":"p","text":"The term \u201cpersonal health record\u201d means an electronic record of PHR identifiable health information (as defined in ","children":[{"t":"ref","text":"section 17937(f)(2) of this title","href":"/us/usc/t42/s17937/f/2","tail":") on an individual that can be drawn from multiple sources and that is managed, shared, and controlled by or primarily for the individual."}],"tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/12","children":[{"t":"num","text":"(12)"},{"t":"heading","text":"Protected health information"},{"t":"content","children":[{"t":"p","text":"The term \u201cprotected health information\u201d has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/13","children":[{"t":"num","text":"(13)"},{"t":"heading","text":"Secretary"},{"t":"content","children":[{"t":"p","text":"The term \u201cSecretary\u201d means the Secretary of Health and Human Services.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/14","children":[{"t":"num","text":"(14)"},{"t":"heading","text":"Security"},{"t":"content","children":[{"t":"p","text":"The term \u201csecurity\u201d has the meaning given such term in section 164.304 of title 45, Code of Federal Regulations.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/15","children":[{"t":"num","text":"(15)"},{"t":"heading","text":"State"},{"t":"content","children":[{"t":"p","text":"The term \u201cState\u201d means each of the several States, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/16","children":[{"t":"num","text":"(16)"},{"t":"heading","text":"Treatment"},{"t":"content","children":[{"t":"p","text":"The term \u201ctreatment\u201d has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/17","children":[{"t":"num","text":"(17)"},{"t":"heading","text":"Use"},{"t":"content","children":[{"t":"p","text":"The term \u201cuse\u201d has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"para","id":"/us/usc/t42/s17921/18","children":[{"t":"num","text":"(18)"},{"t":"heading","text":"Vendor of personal health records"},{"t":"content","children":[{"t":"p","text":"The term \u201cvendor of personal health records\u201d means an entity, other than a covered entity (as defined in paragraph (3)), that offers or maintains a personal health record.","tail":"\n"}],"tail":"\n"}],"tail":"\n"},{"t":"text","text":"\n"},{"t":"text","text":"\n"}]}]}