§ 17921 — Definitions

In this subchapter, except as specified otherwise: (A) The term “breach” means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information. (B) The term “breach” does not include— (i) any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if— (I) such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate; and (II) such information is not further acquired, accessed, used, or disclosed by any person; or (ii) same facility; and (iii) any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person. (2) The term “business associate” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (3) The term “covered entity” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (4) The terms “disclose” and “disclosure” have the meaning given the term “disclosure” in section 160.103 of title 45, Code of Federal Regulations. (5) The term “electronic health record” means an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff. (6) The term “health care operation” has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. (7) The term “health care provider” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (8) The term “health plan” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (9) (10) The term “payment” has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. (11) The term “personal health record” means an electronic record of PHR identifiable health information (as defined in section 17937(f)(2) of this title) on an individual that can be drawn from multiple sources and that is managed, shared, and controlled by or primarily for the individual. (12) The term “protected health information” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (13) The term “Secretary” means the Secretary of Health and Human Services. (14) The term “security” has the meaning given such term in section 164.304 of title 45, Code of Federal Regulations. (15) The term “State” means each of the several States, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands. (16) The term “treatment” has the meaning given such term in section 164.501 of title 45, Code of Federal Regulations. (17) The term “use” has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations. (18) The term “vendor of personal health records” means an entity, other than a covered entity (as defined in paragraph (3)), that offers or maintains a personal health record.