Health Exchange Security and Transparency Act of 2014

I thank the distinguished gentleman, and I thank the manager of this legislation, and I thank the good intentions of our colleagues.

I want to pause for a moment, Mr. Pallone, and just simply say that although these are important issues, as a member of the House Judiciary Committee, I helped draft the PATRIOT Act and business record 215, and we are now looking to constrain the collection of mega-data, and I accept the importance of privacy for the American people. But I pause for just a moment to ask my colleagues, we have enough time today to actually pass the extension of the unemployment benefits. There are 1.3 million people, 12,000 in my own community, who would like us to stay here and make sure that we get that done. I hope that my friends on the other side of the aisle will accept the challenge of Republicans putting an extension of the unemployment benefits on the floor to help unemployed Americans.

But this is an important issue as well, and I do want to say that our friends have not documented any breach on personal and private data of those individuals that have accessed the Affordable Care Act, which are 9 million plus, and growing. We have had 46 votes to repeal it. Now we come one by one with legislation that has not gone through regular order. It has not gone through the committee process. It has very good intentions; but, in actuality, it may be overly burdensome because, Mr. Speaker, there is no bar. There is no limit for HHS to provide notice for any possible breach within seconds or minutes or hours after the incident may have occurred.

Frankly, this legislation doesn't go far enough. Let me give you a few facts. The Affordable Care Act implementation of healthcare.gov is under the authority of HHS. HHS assigned the task for developing healthcare.gov to the agency's Center for Medicare and Medicaid Services. Under the Federal Privacy Act, all Federal agencies must draft regulations to protect personally identifiable information under their control.

The Federal Privacy Act was established by an act of Congress and concurrence of the executive branch to balance the government's need to maintain personal information on Americans with the right of individuals to be protected against unwarranted invasions of their privacy.

The Privacy Act came as a direct result of the work of the Church Committee following revelations that the government has routinely used records on citizens for political purposes to engage in surveillance or retaliatory activity. There were a series of laws

passed by Congress to protect the privacy of Americans.

Computer records management was of such grave concern to Members of Congress following investigations into disclosures that then-President Nixon had used his high office to seek out by means to exact retribution against political enemies by causing harm to careers, reputations as well as financial injury through IRS audits.

So we have had an intense interest since the report ``Records, Computers, and the Rights of Citizens'' was produced in 1973. HHS is chiefly responsible for why the United States became the first Nation in the world to draft a Federal privacy law. They know what to do. They developed the Code of Fair Information practices which have five principles, one of which says there must be no personal data recordkeeping systems whose very existence is secret, that is, to not use the data of people in the wrong way.

There is the CMS Policy for Privacy Act, and I offer this for the Record.

The baseline of my point is that HHS was at the core of developing privacy. There have been no known breaches. There is no bar for CMS and HHS to tell the American public or the individual immediately.

This bill will add burdensome requirements and may--it may--distract or take away from legal and lawful law enforcement investigations. I ask that we look at this together in a bipartisan manner. I believe in privacy. I hope we can work together, Mr. Pallone, and make this what it should be; but I think the American people are protected.

Mr. Speaker, I rise to speak on H.R. 3811, the Health Exchange Security and Transparency Act of 2014.

I would like to commend the author of the bill for the focus on privacy.

Privacy protection is a policy area that has strong bi-partisan agreement.

However, because H.R. 3811 did not go through regular order there was no opportunity for the Committees of jurisdiction to provide valuable input into its drafting.

I would like to offer a few facts that may make it clear that this bill, although well intentioned is not necessary in its current form.

The Affordable Care Act implementation of healthcare.gov is under the authority of the Department of Health and Human Services (HHS).

HHS assigned the task for developing healthcare.gov to the agency's Centers for Medicare & Medicaid Services (CMS).

Under the Federal Privacy Act all federal agencies must draft regulations to protect personally identifiable information under their control.

The Federal Privacy Act was established by an act of Congress and concurrence of the Executive Branch to balance the Government's need to maintain personal information on Americans with the right of individuals to be protected against unwarranted invasions of their privacy.

The Privacy Act came as a direct result of the work of the Church Committee following revelations that the government had routinely used records on citizens for political purposes to engage in surveillance or retaliatory activity a series of laws were passed by Congress to protect the privacy of Americans.

Computer records management was of such grave concern to members of Congress following investigations into disclosures that then President Nixon had used his high office to seek out means to exact retribution against political enemies by causing harm to careers, reputations as well as financial injury through IRS audits.

In 1973, a report ``Records, Computers, and the Rights of Citizens'' was produced by the former Federal Department of Health Education and Welfare (HEW), which today exists as two agencies one of which is the Department of Health and Human Services (HHS) established the first federal agency privacy policies for information held on Americans.

HHS is chiefly responsible for why the United States became the first nation in the world to draft a federal privacy law.

HHS developed the Code of Fair Information practices which later became the basis for the Federal Privacy Act.

The Code of Fair Information Practices has five principles:

There must be no personal data record-keeping systems whose very existence is secret.

There must be a way for a person to find out what information about the person is in a record and how it is used.

There must be a way for a person to prevent information about the person that was obtained for one purpose from being used or made available for other purposes without the person's consent.

There must be a way for a person to correct or amend a record of identifiable information about the person.

Any organization creating, maintaining, using, or disseminating records of identifiable personal data must assure the reliability of the data for their intended use and must take precautions to prevent misuses of the data.

The Federal Privacy Act protects all personal information managed by Federal agencies.

We know that not all agencies do a good job at protecting the personal information of citizens so today's focus on privacy is relevant and important.

However, our focus should be much broader and better informed regarding the work of each agency in this area.

Committee hearings would have been beneficial in informing the drafters of H.R. 3811, prior to its introduction on the Floor of the House for a vote.

For example, authors of the bill may have taken a different approach if it was acknowledged that the CMS has several policy documents specific to the topic of protecting personal identifiable information of medical records data:

CMS Policy for Privacy Act Implementation & Breach Notification (7/ 23/07)

Risk Management Handbook Volume III Standard 7.1 (12/6/12)

Incident Handling and Breach Notification

CMS Privacy Policy is written to meet obligations established by the Federal Privacy Act of 1974 (5 U.S.C., 552a), the Computer Matching and Privacy Protection Act of 1988 (Public Law 100-503) and the Department of Health and Human Services Privacy Act Regulations (45 C.F.R. Part 5b).

I want to assure my colleagues that under the Federal Privacy Act all Federal agencies must ``develop an effective response to [breaches] that requires disclosure of information regarding the breach to those individuals affected by it, as well as to persons and entities in a position to cooperate, either by assisting in notification to affected individuals or playing a role in preventing or minimizing harms from the breach.''

All agencies, which include CMS, must report all incidents involving personally identifiable information to US-Computer Readiness Team or (US-CERT).

The US-CERT reporting requirement does not distinguish between potential and confirmed breaches--all must be reported within 1 hour of discovery/detection.

The CMS policy on breach notification has 5 criteria to determine if a breach has occurred:

Nature of the Data Elements Breached

Number of Individuals Affected

Likelihood the Information is Accessible and Usable

Likelihood the Breach May Lead to Harm

Ability of the Agency to Mitigate the Risk of Harm

CMS is directed to provide notification without unreasonable delay following the discovery of a breach, consistent with the needs of law enforcement and any measures necessary for CMS to determine the scope of the breach and, if necessary, to restore the integrity of the computerized system.

The consideration of Law-enforcement in government agency breaches is very important because this type of crime can take place in seconds or it may occur over hours, days, weeks or months.

Law-enforcement in investigation of data breaches attempts to identify the culprit(s) and others who may be involved.

To avoid impeding the efforts of law-enforcement or national security H.R. 3811, the Health Exchange Security and Transparency Act of 2014 should have included a law-enforcement exception.

Responsibility for information on individuals whose personally identifiable information has been breached is the CMS Administrator the highest official of the agency.

However, if the data breach is under 50, the notice may also be issued by the CMS Chief Information Officer or Senior Official for Privacy.

CMS Breach Notification to individuals must be in writing that should be ``concise, conspicuous, and in plain language'' and include the following:

Brief description of what happened, including date(s) and its discovery;

Description of the types of information involved in the breach;

Whether the information was encrypted or protected by other means when determined the information may be useful or compromise the security of the system;

What steps individuals should take to protect themselves from potential harm;

What the agency is doing; and

Who affected individuals should contact

There is no evidence that healthcare.gov had a breach of personal information.

If such a breach had occurred it would not be secret and members of this body would have been briefed.

First, the most important rule for cyber security is following the example of the professionals who work in this fast paced area: truth comes before beauty. The truth is that there is no computer system that is 100 percent secure from hostile cyber attacks, natural disasters, structural failures or human errors.

Second, the Internet is a rough neighborhood--the best we can do is to design the best systems possible provide the resources necessary to follow through on good security and privacy designs and ignore the politics of the moment. The most dangerous threats to cyber security do not care about anyone's political party they may care very much about your nation of origin.

Third, cyber security is not about the 14 year old with a laptop, but the botnet attack from a coordinate effort that brings to the discussion significant threats to networks. There is no evidence that nothing occurred that would suggest that the website experienced anything of this nature.

Congress should use regular order to consider means and methods of securing all federal data that is categorized as personally identifiable information.

Attempts to misinform or frighten Americans regarding the healthcare.gov or the Patient Protection and Affordable Care Act implementation mechanisms are unwarranted.

CMS has a detailed and well managed program for ensuring that personally identifiable information is secure and when questions arise they have a top level ``Incident Handling'' protocol that is through in investigating issues and uncovering the facts regarding suspected breaches.

CMS relies upon US-CERT, which is part of DHS' National Cybersecurity and Communications Integration Center (NCCIC) to address breaches of data it manages.

The Department of Homeland Security's United States Computer Emergency Readiness Team (US-CERT) leads efforts to improve the nation's cybersecurity posture, coordinate cyber information sharing, and proactively manage cyber risks to the Nation while protecting the constitutional rights of Americans.

CMS informs US-CERT within an hour of a suspected breach incident.

However, a report does not mean that an incident occurred an investigation must proceed to determine if the report is valid.

It is important note that premature breach notices being sent to consumers regarding their personally identifiable information could have unintended and adverse outcomes for several reasons:

Notice fatigue--too many notices and people stop paying attention;

Increased cost of administering a program due to additional communications that inform people that the initial breach notice was a false alarm;

Giving notice to cyber criminals or terrorists that they have been discovered before law enforcement or national security can assess how the extent of the threat, the target or objective of the attack and trace the source of the threat with the goal of identifying the culprits; and

Correcting the problem that allowed the breach to occur

HHS should only collect the personally identifiable information that is necessary, used it for the purpose of the collection and promptly discarded that data so no database or system of records is created.

I commend my colleagues for the focus on Privacy and hope that we can work together to improve the protection of personal information on Americans throughout the Federal Government.

I strongly recommend that my colleagues vote to send this bill back for committee consideration so that its goal of improving privacy protection can be better matched to the reality of what CMS is currently doing in the area of breach notification, which conforms to what Americans need and law-enforcement as well as national security must have to protect federal agency computer networks.

1 Introduction

CMS must be able to respond to computer security-related

and/or privacy-related incidents in a manner that protects

its own information and helps to protect the information of

others that might be affected by the incident.

This Risk Management Handbook Volume III, Standard 7.1,

Incident Handling and Breach Notification standard, along

with the companion procedures of the RMH Volume II, Procedure

7.2, Incident Handling, supersedes the CMS Information

Security (IS) Incident Handling and Breach Analysis/

Notification Procedure dated December 3, 2010.

1.1 Background

1.1.1 SECURITY EVENT

A Security Event is an observable occurrence in a network

or system (e.g., known or suspected penetrations of

information Technology (IT) resources, probes, infections,

log reviews), or any occurrence that potentially could

threaten CMS data confidentiality, integrity, or

availability.

1.1.2 REPORTABLE EVENT

A Reportable Event is any activity or occurrence that

involves:

A matter that a reasonable person would consider a

violation of criminal, civil, or administrative laws

applicable to any Medicare contract or federal health care

program.

Integrity violations, including any known, probable, or

suspected violation of any Medicare contract term or

provision.

A matter considered to have an ``adverse'' impact on the IT

system/infrastructure or CMS data confidentiality, integrity,

or availability. Examples of specific events that should be

reported include (but are not limited to):

Unauthorized access to or use of sensitive data for illegal

purposes.

Unauthorized altering of data, programs, or hardware.

Loss of mission-essential data (i.e., patient, financial,

benefits, legal, etc.).

Environmental damage/disaster (greater than $10,000)

causing loss of IT services or data, or which may be less

than $10,000 in damage yet affect CMS' ability to continue

any day-to-day functions and operations.

Infection of sensitive systems, firmware, or software by

malicious code (i.e., Viruses, Worms and Trojan Horses,

etc.).

Perpetrated theft, fraud, vandalism, and other criminal

computer activity that did, or may, affect the organization's

capabilities to continue day-to-day functions and operations.

Telecommunications/network security violations, i.e.,

networks (including local area networks [LANs], metropolitan

area networks [MANs], and wide area networks [WANs]) that

experience service interruptions that cause an impact to an

indefinite number of end users.

Unauthorized access to data when in transmission over

communications media.

Loss of system availability affecting the ability of users

to perform the functions required to carry out day-to-day

responsibilities.

Root-level attacks on networking infrastructure, critical

systems, or large, multi-purpose, or dedicated servers.

Compromise (or disclosure of account access information) of

privileged accounts on computer systems.

Compromise (or disclosure of account access information) of

individual user accounts or desktop (single-user) systems.

Denial-of-service attacks on networking infrastructure and

systems.

Attacks launched on others from within organizational

boundaries or systems.

Scans of internal organizational systems originating from

the Internet or from within the organizational boundaries.

Any criminal act that may have been committed using

organizational systems or resources.

Disclosure of protected data, including paper disclosure,

email release, or inadvertent posting of data on a web site.

Suspected information-technology policy violation.

A Reportable Event may be the result of an isolated event

or a series of occurrences. Reportable Events under these

procedures include events that occur at CMS federal sites,

contractor/subcontractor sites/systems, consultants, vendors

or agents. If the Reportable Event results in an overpayment

relating to either Trust Fund payments or administrative

costs, the report must describe the overpayment with as much

specificity as possible, as of the time of the due date for

the submission of the report.

Security events that may consist of an observable

occurrence in a network or system (e.g., detected probes,

infections prevented, log reviews, etc.), that do not

threaten system integrity, are not considered Reportable

Events unless they may be reasonably associated with other

incidents, Reportable Events, or breaches. CMS categorizes

these events in a monthly report to the Department of Health

and Human Services (HHS) (hereafter referred to as the

``Department'' or ``HHS'') Cybersecurity Program as follows:

Malicious Code Prevented: Viruses were prevented and did

not cause any harm to any system.

Probes and Reconnaissance Scans Detected: Probes and scans

were detected but did not pose a serious threat to a CMS

system.

Inappropriate Usage: Misuse of computing resources by an

otherwise authorized individual.

Other: Cannot be categorized under any of the above and do

not threaten system integrity.

There are many events that may be flagged as inappropriate

use of resources, but reflect situations that do not fall

under the definitions associated with incidents, Reportable

Events, or breaches. In such cases, reporting should be made

through applicable contractual resources, or through

appropriate Federal Fraud, Waste, and Abuse reporting

channels.

1.1.3 PRIVACY INFORMATION

Privacy is the right of an individual to control their own

personal information, and not have it disclosed or used by

others without permission. At CMS, we are charged with

protecting other people's private information--that of every

citizen (or legal resident) beneficiary utilizing benefits

the vast Medicare/Medicaid program, as well as many

subsidiary programs.

Confidentiality is the obligation of another party to

respect privacy by protecting personal information they

receive, and preventing it from being used or disclosed

without the subject's knowledge and permission.

Again, at CMS we are charged with protecting the

confidentiality of other people's citizen-beneficiary

information. A breach of that confidentiality is not simply a

failure of a ``technical control'', it is a basic failure of

CMS to meet its obligation to protect the individual citizen.

Moreover, unlike the banking industry where financial

compensation is a readily-available remedy to a breach,

private medical information cannot be simply replaced with

something of ``similar value'', or by simply closing an

account, and opening a new (better protected) one. Once a

privacy breach occurs, the ramifications can be far-reaching

and long lasting--with no readily available ``patch'' to undo

the damage (we cannot simply replace one violated health

record with a brand new one.)

Security is the means used to protect the confidentiality

of personal information through physical, technical, and

administrative safeguards.

Privacy is the ``business objective'' of security. The core

of the relationship between information security and

information privacy lies in the fact that security, or lack

of it, is the determinant of the level of privacy that a

system or infrastructure can assure. If there is a breach of

computer security, it has a corresponding negative effect on

the confidentiality, integrity, and availability of the

information therein. Inadequate security leads directly to

loss of privacy. Therefore, if privacy is the ``business

objective'', then security is the ``functional requirements''

necessary for an IT system to meet those ``business

objectives''.

1.1.3.1 PERSONALLY IDENTIFIABLE INFORMATION (PII)

Personally Identifiable Information (PII) is information

which can be used to distinguish or trace an individual's

identity, such as their name, social security number,

biometric records, etc. alone, or when combined with other

personal or identifying information which is linked or

linkable to a specific individual, such as date and place of

birth, mother's maiden name, etc. PII also includes

individually identifiable health information as defined by

the Health Insurance Portability and Accountability Act

(HIPAA) of 1996, Privacy Rule (45 CFR Section 164.501. PII is

also often referred to as personally identifiable data or

individually identifiable information.

1.1.3.2. Protected Health Information (PHI)

Protected Health Information (PHI) is individually

identifiable health information held or transmitted by a

covered entity or its business associate, in any form or

media, whether electronic, paper, or oral.

Individually Identifiable Health Information is a subset of

health information, including demographic data collected

concerning an individual that:

Is created or received by a healthcare provider, health

plan, employer, or healthcare clearinghouse.

Relates to the past, present or future physical or mental

health or condition of an individual; the provision of

healthcare to an individual; or the past, present, or future

payment for the provision of healthcare to an individual, and

meets either of the following:

Identifies the individual.

There is a reasonable basis to believe the information can

be used to identify the individual.

The HIPAA Privacy Rule excludes from the definition of PHI

individually identifiable health information that is

maintained in education records covered by the Family

Educational Right and Privacy Act (as amended, 20 U.S.C.

1232g) and records described at 20 U.S.C. 1232g(a)(4)(B)(iv),

and employment records containing individually identifiable

health information that are held by a covered entity in its

role as an employer.

The HIPAA Privacy Rule covers PHI in any medium (including

paper) while the HIPAA Security Rule covers PHI in electronic

form (ePHI) only.

1.1.3.3 DE-IDENTIFIED HEALTH INFORMATION

With those definitions in place, what information (or data)

elements comprise PHI such that, if they were removed, the

above definition of individually identifiable health

information would not apply? The answer is in the HIPAA de-

identification use standard and its two implementation

specifications of the HIPAA Privacy Rule.

There are no restrictions on the use or disclosure of de-

identified health information. De-identified health

information neither identifies nor provides a reasonable

basis to identify an individual. There are two specifications

for de-identifying individually identifiable health

information; either: 1) a formal determination by a qualified

statistician; or 2) the removal of specified identifiers of

the individual and of the individual's relatives, household

members, and employers is required, and is adequate only if

the covered entity has no actual knowledge that the remaining

information could be used to identify the individual.

The following identifiers of the individual or of

relatives, employers, or household members of the individual

must be removed to achieve the safe harbor method of de-

identification:

1. Names

2. All geographic subdivisions smaller than a State,

including street address, city, county, precinct, zip code,

and their equivalent geocodes, except for the initial three

digits of a zip code if, according to the current publicly

available data from the Bureau of Census:

a. The geographic units formed by combining all zip codes

with the same three initial digits contains more than 20,000

people.

b. The initial three digits of a zip code for all such

geographic units containing 20,000 or fewer people is changed

to 000.

3. All elements of dates (except year) for dates directly

related to the individual, including birth date, admission

date, discharge date, date of death; and all ages over 89 and

all elements of dates (including year) indicative of such

age, except that such ages and elements may be aggregated

into a single category of age 90 or older.

4. Telephone numbers

5. Fax numbers

6. Electronic mail addresses

7. Social security numbers

8. Medical record numbers

9. Health plan beneficiary numbers

10. Account numbers

11. Certificate/license numbers

12. Vehicle identifiers and serial numbers, including

license plate numbers

13. Device identifiers and serial numbers

14. Web Universal Resource Locators (URLs)

15. Internet Protocol (IP) address numbers

16. Biometric identifiers, including finger and voiceprints

17. Full face photographic images and any comparable

images.

18. Any other unique identifying number, characteristic, or

code, except as permitted for re-identification purposes

provided certain conditions are met

In addition to the removal of the above-stated identifiers,

the covered entity may not have actual knowledge that the

remaining information could be used alone or in combination

with any other information to identify an individual who is

subject of the information.

Mr. Speaker, by direction of the Committee on Rules, I call up House Resolution 455 and ask for its immediate consideration.

Mr. Speaker, for the purpose of debate only, I yield the customary 30 minutes to gentleman from Colorado (Mr. Polis), pending which I yield myself such time as I may consume. During consideration of this resolution, all time yielded is for the purpose of debate only.

General Leave

Mr. Speaker, I ask unanimous consent that all Members have 5 legislative days to revise and extend their remarks.

Mr. Speaker, House Resolution 455 provides for the consideration of three important bills which were reported by the Energy and Commerce Committee: H.R. 2279, the Reducing Excessive Deadline Obligations Act of 2013; H.R. 3362, the Exchange Information Disclosure Act; and H.R. 3811, the Health Exchange Security and Transparency Act of 2014.

H.R. 2279 is a bill to address the burdensome and outdated deadlines for certain rulemaking activities conducted by the Environmental Protection Agency under the Solid Waste Disposal Act and the Comprehensive Environmental Response, Compensation, and Liability Act. This provides flexibility for the Environmental Protection Agency in order to streamline a process critical to cleaning up sites contaminated with certain toxic or hazardous chemicals.

It further requires the Environmental Protection Agency to evaluate existing State or other Federal financial insurance requirements to determine whether additional requirements are, in fact, necessary.

Finally, it requires the owner or operator of a chemical storage site to report the presence of such chemicals to the State emergency response commissions.

It is a commonsense piece of legislation to help clean up areas that have been polluted and allows for their reclamation or development. This could bring jobs and economic benefits to neighborhoods which have been so affected.

As the two health care-related pieces of legislation, these are targeted bills to address just a few of the massive problems the American public has witnessed over the last few months pertaining to the calamitous rollout of the Federal www.healthcare.gov Web site. The data obtained by www.healthcare.gov is one of the largest collections of personal information ever assembled. It links information between seven different Federal agencies, State agencies, and government contractors.

In promising lower costs and widespread health coverage for Americans, President Obama failed to mention that the Affordable Care Act's mandates and requirements will create large-scale disruption of the entire health insurance market. The resulting cancelation of insurance plans and high cost for employers to continue providing insurance for their workers has left millions of Americans with no choice other than to purchase health insurance through the Affordable Care Act's exchanges, subjecting their personal information to the vulnerable security infrastructure.

The initial launch of www.healthcare.gov on October 1, 2013, was plagued with glitches and errors. Not only did the administration fail to establish basic functionality of the Web site, but the initial problems really only break the surface of the deeper security threats in the underlying law. A multitude of gaps remain in the Web site's security infrastructure, making the Web site a wide-open target for hackers and identity thieves. These flaws continue to pose a threat to the security of Americans' personal data.

Mr. Speaker, it wasn't that the administration was not alerted to these security concerns on the Web site prior to the launch. MITRE Corporation, a contractor for the Department of Health and Human Services, alerted the agency that 19 unaddressed security vulnerabilities plagued the Web site prior to its launch on October 1. Top officials at the Centers for Medicare and Medicaid Services, including the chief information security officer, Teresa Fryer, along with the Web site's project manager, Tony Trenkle, both refused to sign the Authority to Operate license that was necessary to actually launch www.healthcare.gov. Despite these known issues, the director of the Centers for Medicare and Medicaid Services, Marilyn Tavenner, continued to launch the Web site.

This is much more than a faulty Web site. This is about the American people, who cannot trust their government to certify that their personal information will be safe on a government-run Web site.

The security threat goes beyond just an individual's primary application. Once an individual's personal information is entered into the system, the exchange has the ability to access information within the Department of Homeland Security, the Internal Revenue Service, Social Security, and the Treasury Department. The administration has opened numerous Federal agencies to data breaches and unauthorized access.

Just before the holidays, the entire Nation saw firsthand what a massive security breach looks like. Over 40 million Target customers, their personal data was compromised by computer hackers who pilfered personal financial information and identification.

Target has gone out of their way to alert customers of the security breach. Unfortunately, the Federal Government has no such obligation under the law. This is a point that I don't think most people are aware of. It is not required. It is not a mandate that you have a Target charge card or that you shop at Target, but it is certainly required and a mandate that you buy your insurance through www.healthcare.gov. This is a coercive Federal policy that now is pulling people into its Web site and refuses to provide them the very same protection that we demand that the private sector do for a voluntary purchase.

Instead of following the same requirements placed on the private sector, the Federal Government has gone out of their way to avoid imposing this basic due diligence in their own exchanges. Even when a notification requirement was specifically requested during the rulemaking process on the exchanges, the administration just simply refused.

In the March 27, 2012, Federal Register, Department of Health and Human Services responded, stating:

We do not plan to include the specific notification

procedures in the final rule. Consistent with this approach,

we did not include specific policies for investigation of

data breaches in this final rule.

Furthermore, State laws required that many of the 14 State-run insurance exchanges, that they do disclose such information. No such law exists for the federally run exchange. Mr. Speaker, I would remind you that 36

States rely upon the federally run exchange.

Look, we have spent hundreds of millions of dollars, taxpayer dollars. The American people deserve to know that their personal information is protected and to be notified if that protection lapses.

Let's be honest: www.healthcare.gov is the most talked about Web site in years. The massive amounts of personal information that is collected through www.healthcare.gov and its ability to access multiple government databases creates the perfect environment for targeting by hackers.

Over 16 attempts to hack into the system have already been reported, not to mention the many stories that have been reported in the press on the mishandling and sharing of individuals' data. Identity theft is a threat not only to an individual's credit rating and personal finances but also to overall United States security. Most Americans would be shocked to learn that this level of protection is not already in place for an initiative the size of the Affordable Care Act. Well, today the House is working to correct this injustice, protecting Americans when the administration has refused to do so.

The Obama administration has consistently refused to disclose detailed data on how many Americans have actually completed the Obama Care enrollment process. Now it is more than 3 months after the launch of the exchanges, and we just simply do not know how many Americans are enrolled in the exchange plan.

It was the administration who initially defined the success of the exchange as the number of Americans who actually enroll in the program. The number of enrollments are the only way to evaluate whether the more than $1 trillion that was spent on this thing by the administration is actually working.

The President's commitment to an open and transparent government, repeated so many times during the passage of the Affordable Care Act, represents yet one more broken promise in a long string of broken promises.

Where this administration has failed, the bill before us will require the Secretary of the Department of Health and Human Services to provide detailed weekly reports to the American people about the enrollment number on healthcare.gov. The American people deserve to know what they are getting for their hard-earned tax dollars that they have spent on the demands of this administration.

It is the American people who are suffering because of the mismanagement and failures of this administration. Today--today--we have the opportunity to provide transparency and protect Americans' personal information.

The rule before us today provides for 1 hour of debate equally divided between the majority and the minority for each of the bills contained in the rule. The minority is further afforded the customary motion to recommit on each piece of legislation.

I want to encourage my colleagues to vote ``yes'' on the rule and ``yes'' on the underlying bills and stand with the millions of Americans who are asking and who are demanding that we protect their privacy.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I now would like to yield 4 minutes to the gentleman from Georgia, Dr. Collins.

Mr. Speaker, may I inquire as to the time remaining?

Mr. Speaker, I yield myself 2 minutes.

Mr. Speaker, it is often said those who don't remember their history are doomed to repeat it.

The Rules Committee is an important function of this House. It is an important function of this body. Prior to 3 years ago, the Rules Committee was under the jurisdiction of the Democrats. They controlled the Rules Committee throughout the entirety of the 111th Congress. You may recall, that was the first 2 years of the first Obama term. In those 2 years under Speaker Pelosi, this was the first Congress in history--the first Congress in the history of the Republic--not to have a single bill considered under an open rule process.

Now, since Republicans resumed the majority at the beginning of 2011, 31 bills have come under an open rule. The track record may not be perfect, but it is inestimably better than what preceded it.

I reserve the balance of my time.

Mr. Speaker, I tire of going through this history lesson every time we come down to the floor, but may I remind you that when the now-Affordable Care Act was passed into law, this was a bill that came over to the House from the Senate. Sure enough, the House had sent the bill over to the Senate in July of 2009, H.R. 3590. It was a bill that dealt with housing. The bill that dealt with housing was amended. The amendment read, ``Strike all after the enacting clause and insert,'' and the health care language, which was de novo, the health care language was inserted.

Now, to be sure, the House had considered a health care reform bill, H.R. 3200. H.R. 3200 has gone to the ether of history. H.R. 3590 passed in the Senate, a 60-vote margin on Christmas Eve in 2009, and then was thrown over to the House of Representatives. Did we have a hearing on H.R. 3590 in the Committee on Energy and Commerce? No, we did not. Did they have a hearing in the appropriate subcommittee of Ways and Means on H.R. 3590, as amended? No, they did not.

The bill came to the Rules Committee. It came to the Rules Committee. I attempted to offer amendments. I was told, No, thank you. The bill was perfect the way it is, doesn't need any changes. This bill that affects every man, woman, and child in this country for the next three decades in a very unfavorable way was passed without any input from the then-minority, the Republicans in the House of Representatives.

So it is beyond comprehension that we can continue to have these arguments about closed processes. This, after all, is the granddaddy of all closed processes. And the consequence, the drafting errors, the problems embedded in the structure, could not be dealt with during the normal legislative process, which is why so much authority has been transferred to the executive branch, to the agencies, and why they are now essentially writing the laws that affect so many Americans.

I reserve the balance of my time.

Mr. Speaker, I yield myself 1 minute.

I would point out this bill before us today does not--does not-- change the Superfund, but it does allow States the flexibility to deal with problems in their States as they see fit.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I would like to inquire, does the gentleman have any other speakers? If not, I am prepared to close.

Mr. Speaker, I yield myself the balance of my time.

Mr. Speaker, one of the questions for people who have been watching this debate, I'm sure one of the questions that they have, is there any difference as to how the private sector is treated if and when a data breach occurs versus a Federal agency? The simple fact of the matter is there is a difference.

The private sector is governed under State laws and, yes, by some Federal regulations as well.

In fact, earlier this month, in a publication called The Hill, entitled, ``Target's data breach sparks calls for action,'' there was significant discussion about, perhaps, there being more activity on the part of the Federal Trade Commission in protecting consumers who have been exposed to a data breach.

What are the protections for people harmed with a data breach by the Federal Government?

In fact, for that, there is not legislation, there is not a law that was signed by any administration, but there is an executive order of the President's, dating from May 22, 2007, a so-called OMB Circular.

The OMB Circular dealing with data breaches under the section ``Timeliness of the Notification'' reads:

Agencies should provide notification without unreasonable

delay following the discovery of a breach, consistent with

the needs of law enforcement and national security and any

measures necessary for your agency to determine the scope of

the breach and, if applicable, to restore the reasonable

integrity of the computerized data system compromise.

Decisions to delay notification should be made by the agency

head.

You get the impression that this is, perhaps, a rather open-ended or diffuse or poorly defined timeliness of notification for our constituents who are harmed by a data breach by a Federal agency. So that is one of the problems that we are here today to correct.

Today's rule provides for the consideration of a critical jobs bill and critical security bills to clean up our environment and to protect Americans' personal data.

I certainly want to thank Mr. Gardner, Mr. Terry and Chairman Pitts for their thoughtful bills.

I urge my colleagues to support both the rule and the underlying pieces of legislation.

Mr. Speaker, I urge an ``aye'' vote on the previous question. I yield back the balance of my time, and I move the previous question on the resolution.

I yield myself such time as I may consume.

I thank the gentleman, Mr. Burgess, for yielding me the customary 30 minutes.

Mr. Speaker, I rise in opposition to the rule today under which three bills are being brought to the floor: H.R. 3811, the Health Exchange Security and Transparency Act; H.R. 2279, the Reducing Excessive Deadline Obligations Act; and H.R. 3362, the Exchange Information Disclosure Act. You wouldn't know by their names what those bills actually do. I discuss that, and, more importantly, I plan to discuss, Mr. Speaker, what these bills fail to accomplish.

These misguided and superfluous bills were brought under a very restrictive process. Two of them are being brought to the floor under a completely closed rule that blocks all efforts by Members to improve the legislation. Democrats yesterday on the Rules Committee proposed an open rule for these bills allowing Members from both sides of the aisle to offer their ideas to make them better, and it was voted down in the Rules Committee in a partisan vote.

Instead of moving forward and tackling challenges like extending unemployment, which has been talked about, or passing a jobs bill or an infrastructure bill or fixing our broken immigration system or reforming our tax system, again, we are discussing bills relating to the Affordable Care Act that don't seek to improve the act and make it work better for the American people but only add more paperwork and bureaucracy and cost to the health care system we already have by putting additional requirements on Federal workers and others that are working hard to ensure that ObamaCare works for America every day. Of the 112 legislative days we have left this year, we need to ensure that we spend them wisely, and I don't think that these three bills are a good way for us to use 2 days of our time.

The first bill, H.R. 3362, calls on HHS to publish weekly reports on consumer interactions with healthcare.gov, including the details of all calls received by the call center. Now, much of this information is already available monthly. There are already reliable updates on enrollment numbers and numerous updates on the Web sites and issues consumers have encountered. Look, while you are fixing the Web site and getting it working is not the time to put additional requirements on those that are laboring to ensure that Americans can sign up for affordable health care. Again, it is more information about who is calling and what they are doing weekly rather than monthly will provide an additional workload for those who are trying to make sure that the Web sites are functioning for America.

It will actually make it harder for the Web sites to function by having to divert some effort if this were to become law simply to building reporting requirements that were mandated by Congress. It is almost as if this bill was designed to make the Web site work worse, Mr. Speaker, by moving developers and others, without any additional resources, away from making the necessary improvements towards building entirely new reporting systems just so people can have information weekly instead of monthly.

It would be great, first of all, to have information weekly. I would love to have information daily. I would love to have information realtime. I used to run an Internet company. It would be wonderful to have that information. You have to weigh the costs and benefits and say, Is it worth building into this system realtime reporting? What are we forgoing by doing that? Is it worth it to say we want the information weekly instead of monthly?

Again, if you are building it from scratch and perhaps if the Republicans had offered this as an amendment into the original Affordable Care Act, maybe this could have been incorporated in 3 years ago and we could have built a system with either realtime or weekly reporting. But here where we are today, clearly the top priority needs to be that this Web site works well for the American people so they can get affordable health care for themselves and their family. That is what the American people want.

Now, let's talk about security and safeguards for consumer information. Again, you have the germ of a good idea. Of course, when the government has our personal information, we need to make sure that there are adequate safeguards. That goes for the IRS, it goes for military personnel files, and it goes for the Affordable Care Act, just as we want to make sure that when the private sector and companies have our personal information that they institute the proper safeguards. And there are examples of failure. Mr. Burgess mentioned Target as a private-sector example of failure.

We certainly hope that we have the infrastructure and security in place to ensure that there is not a failure of security with regard to the Affordable Care Act. But when we are talking about identity theft and how to address it, we need to look at where the real problem is. What is the leading cause of identity theft? Is it the IRS? Is it the Affordable Care Act? Is it the military? No. One of the biggest causes of breaches of personal information is our

broken immigration system, the fact that many immigrants in our country are here with fake paperwork, fraudulent Social Security numbers they have purchased or stolen--and H.R. 15, the bipartisan comprehensive immigration reform package, which in a very similar form has already passed the Senate, would address this.

So if we actually want to reduce identity theft and breaches of security and safeguard, Mr. Speaker, personal information for the American people, we should address the real problem rather than one of many hypothetical problems that, again, is no doubt worthy of discussion, but let's address where immigration--where identity theft actually occurs.

According to the Center for Immigration Studies, which has done a lot of work on identity theft from those who are here illegally, experts suggest that 75 percent of people who are here illegally and working use fraudulent Social Security cards to obtain employment. Again, Americans are the victims of this theft. Children are prime targets. Their report indicates that in Arizona it is estimated that there are thousands of children that are victims of identity theft. H.R. 15 contains mandatory E-Verify, which the Center for Immigration Studies says would curb and stop virtually 100 percent of child identity theft.

So, I mean, if we are serious, Mr. Speaker, about doing something about the fact that drivers licenses and Social Security numbers are being stolen, well, let's pass immigration reform. Let's make sure that people who are working in our country and have a role here have some kind of provisional work permit, some prospect of a pathway to citizenship over many years or decades, and that we have a mandatory E- Verify mechanism of checking, a way of verifying at the employer level that their paperwork is authentic and it is not, in fact, stolen from an innocent American, as it is today. So that would address identity theft. That would address fraud.

We have people today that actually, under our current laws, are incentivized to steal information--personal information--from American people. Our immigration system is clearly broken. We need to fix it. H.R. 15, the House's bipartisan, comprehensive immigration reform bill, would create a mandatory employment eligibility verification program. Currently, only 7 percent of employers in our entire country are enrolled in E-Verify to do workplace authentication of those who work here.

So, let's bring this bill to the floor if that is the issue we want to address rather than discuss something that is hypothetically of concern. Yes, of course, we care about secure information in the Affordable Care healthcare.gov site. We care about it in military records, and we care about it in the IRS. But, meanwhile, there are hundreds of thousands of identities being stolen every day, and that is going to continue because this body refuses to bring H.R. 15 to the floor of the House, which would make that number almost zero.

Mr. Speaker, the final bill that this rule brings to the floor is H.R. 2279, the Reducing Excessive Deadline Obligations Act. It is really a package of three bills that would weaken hazardous waste laws like Superfund and the Resource Conservation Recovery Act. It would actually limit the EPA's oversight to ensure that the American people are safe and healthy.

Do we need to remind this body that the reason Congress enacted these safeguards and Superfund is because of tragedies like Love Canal where a residential neighborhood was built on top of 22,000 tons of hazardous waste, and due to the exposure, the residents suffered very high rates of miscarriages, cancers, and birth defects? The situation was so dire that the Federal Government wound up having to evacuate the entire community. That is not the America I want to live in, Mr. Speaker. I oppose H.R. 2279 because it could lead to more situations like Love Canal rather than making sure that the American people are safe and healthy in their homes.

Mr. Speaker, this debate is not really about reporting requirements. It is about making healthcare.gov function less effectively. It is not really about breaches of our personal information. We can solve a big chunk of that by bringing H.R. 15 to the floor of the House. It is not really about improving our competitiveness by removing unnecessary EPA regulations. It is about risking the health of our families.

We need to focus on rebuilding our infrastructure, fixing our broken immigration system, and making sure that we can protect the health of the American people, not jeopardize it.

I reserve the balance of my time.

Mr. Speaker, again the gentleman said there is a risk of information being taken from the healthcare.gov site. There is potential risk from any site. But every day, there are tens of thousands of American identities being stolen because of this body's refusal to simply fix our broken immigration system now.

Mr. Speaker, I yield such time as she may consume to the gentlewoman from New York (Ms. Slaughter), the ranking member of the Rules Committee.

Mr. Speaker, I would remind the gentleman from Texas (Mr. Burgess) that this particular rule has two closed rules on two of the three bills.

With that, I yield 2 minutes to the gentlewoman from Texas (Ms. Jackson Lee).

I yield an additional 30 seconds to the gentlewoman from Texas (Ms. Jackson Lee).

Mr. Speaker, I yield 2 minutes to the gentleman from Virginia (Mr. Connolly).

Mr. Speaker, I yield an additional 30 seconds to the gentleman.

Mr. Speaker, on this 50th anniversary of the war on poverty, 1.4 million Americans have lost emergency unemployment insurance and thousands more stand to lose it each day, each week, that Congress fails to act. If we defeat the previous question, I will offer an amendment to the rule that will allow the House to consider legislation that is identical to the bipartisan measure being considered in the Senate and would restore unemployment insurance to those who have lost it.

Mr. Speaker, I yield 2 minutes to the gentleman from Michigan (Mr. Kildee), a leader in the effort to restore unemployment insurance, to discuss our proposal.

Mr. Speaker, I yield 3 minutes to the gentleman from Maryland (Mr. Hoyer), the Democratic whip.

Mr. Speaker, I yield 1 minute to the gentleman from Rhode Island (Mr. Cicilline).

I am prepared to close.

Mr. Speaker, I ask unanimous consent to insert the text of the amendment in the Record, along with extraneous material, immediately prior to the vote on the previous question.

Mr. Speaker, I urge my colleagues to vote ``no'' and defeat the previous question.

The Senate has passed a bipartisan, comprehensive immigration bill, and the Senate is debating unemployment insurance. Meanwhile, the House hasn't dedicated a single second of legislative floor time to any immigration reform bill that would address identity theft.

Let's move forward and pass bills that matter to the American people rather than political bills that aren't going anywhere.

I urge a ``no'' vote on the rule, and I yield back the balance of my time.

Mr. Speaker, on that I demand the yeas and nays.

Mr. Speaker, I demand a recorded vote.

Mr. Speaker, I yield myself such time as I may consume.

First of all, Mr. Speaker, I want to point out that Republicans are using

out-of-context quotes from an administration, or from administration officials, to mislead the public about the security of healthcare.gov, the Web site.

The same official they keep quoting went on to say:

The added protections that we have put into place are best

practices above and beyond what is usually recommended. And

no Web site is 100 percent secure. But this effort to scare

people from signing up for coverage is simply wrong.

Mr. Speaker, I am afraid the bill before the House today is simply an effort by Republicans to continue to impede the efforts of implementing the Affordable Care Act by instilling misinformation and fear in the American public. It is an egregious bill that would, in my opinion--let me point this out, Mr. Speaker. Yesterday, I was in the Rules Committee, and I pointed out that, to some extent, I was pleased, I guess, that I don't see the Republicans actually coming to the floor today to act on another repeal or outright repeal of the Affordable Care Act. I mean, we are not seeing that. We didn't see it in Rules. And hopefully, I will say to my colleague, the chairman of the Health Subcommittee, that we don't see it again, either in the committee, in Rules, or on the floor.

So maybe there is some progress here, and at least the Republicans are not out there trying to repeal the Affordable Care Act anymore--at least I hope so.

But they are now moving to these other methods of trying to put fear in the public so that they don't sign up or they don't go on the Web site. And the fact of the matter is that these security measures that they are talking about are addressing a reality that is not there.

Do I think that security measures are critical for the Web site?

Yes, absolutely. But let's recap the last few years since the ACA passed. Republicans claim the ACA kills jobs; but since the law has passed, we have added nearly 8 million jobs.

Republicans claim that the ACA causes health costs to increase, but the last 4 years we have seen the slowest health care cost growth in 50 years.

Republicans claim we need to address the deficit; yet they repeal the law at every turn, which increases the deficit by over $1.5 trillion.

Well, now they say that healthcare.gov is going to result in widespread breaches of people's personal information, and that is simply not true. There have been no successful security attacks on healthcare.gov, and no one has maliciously accessed personal information.

No Web site, public or private, is 100 percent secure, but healthcare.gov is subject to strict security standards. It is constantly monitored and tested, and its security and privacy protections go beyond Federal IT standards.

And the Health and Human Services Department has standards in place, just like every other government agency, to notify individuals if their personal information is breached.

So, Mr. Speaker, it is important that I note for everyone that House Democrats have always previously supported legislation to require consumer notification in the event of a breach of government and private sector computer systems. We still do.

By expressing concern for the mockery of this bill, it does not mean that I don't support requiring the administration to notify individuals of breaches of their information, but this not is a serious effort to strengthen privacy laws or to strengthen the health care Web site.

The Republican strategy is to scare people away from going to the Web site and signing up for health care, and I urge Members and the American public, do not be fooled by what they are doing.

It is a good thing that they are not seeking to outright repeal the Affordable Care Act anymore, at least that appears to be the case, based on what happened in Rules the other night. But that doesn't mean that they are not going to continue with these efforts to try to make hay over security and other matters.

And I can't stress enough that every one of the scare tactics they use, whether it is saying that the ACA is going to increase the deficit, which it doesn't, it actually decreases the deficit; or whether they say that it is going to increase health costs, which we know it doesn't, it actually decreases health costs.

This is just another one of those scare tactics. And I just hope that my colleagues, both Democrats and Republicans, are not fooled by this.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I yield 3 minutes to the gentlewoman from Colorado (Ms. DeGette).

Mr. Speaker, I yield an additional 1 minute to the gentlewoman from Colorado.

Mr. Speaker, I yield 3 minutes to the gentleman from Maryland (Mr. Cummings), the ranking member of the House Committee on Oversight and Government Reform.

I yield the gentleman from Maryland an additional 1 minute.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, Republicans continue to attack the Web site, www.healthcare .gov, and this attack on the security of the Web site is just the latest in a long line of scare tactics attempting to limit enrollment and coverage under the ACA.

It just bothers me so much because, as you know now, we have about 6 million people who have obtained coverage, 2.1 million receive private insurance through the Web site, and things really are moving now in terms of more and more people signing up and getting coverage.

I just wish that, rather than using scare tactics and trying to talk about security concerns that don't exist, they would focus and work with us at actually trying to sign people up to get people to have health insurance, which is the goal, of course, of the Affordable Care Act.

The bill suggests that there are serious security problems with www.healthcare.gov, but this unique requirement doesn't apply to other government Web sites or to private Web sites. Under the bill, HHS is required to notify individuals within 2 business days if their personally identifiable information is known to be stolen or unlawfully accessed from a marketplace computer system. If this is a good idea, then why is the GOP bill limiting this requirement to only marketplace Web sites? It is just a missed opportunity.

Democrats firmly support strong data security and breach notification legislation. If the Republicans were serious about the security of personally identifiable information on the Web, instead of bringing up this bill, they could have reached out to Democrats and developed a bipartisan bill.

Indeed, when Democrats were in the majority, the Democrat-run House passed bipartisan legislation to provide for consumer notification in the event of a breach, which was introduced in the previous Congress. And the Republicans are still playing political games. If they want to work with us to bring to the floor serious bipartisan data security breach notification legislation, then they should simply do it.

In the Rules Committee the other day, one of the members asked, on the Republican side, if the administration has a position on the bill. And the administration clearly opposes the bill. They put out an SAP which states:

The Administration believes Americans' personally

identifiable information should be protected wherever it

resides, and that all Americans deserve to know if that

information has been improperly exposed . . . The Federal

Government has already put in place an effective and

efficient system for securing personally identifiable

information in the Health Insurance Marketplaces.

So they oppose the passage of this bill.

I just wish I could convince my colleagues--again, I am happy that this is not an outright repeal and that we are not wasting time on that, but we are still wasting time with this notion of the security breach that hasn't happened when security measures are already in place.

Again, this is being brought up in the first week we are back with no effort to reach out to us in any way to try to deal with this. It has a 2-day notification requirement, which is simply not workable.

I cannot stress enough that we, as Democrats, would like to address this issue, but it is not being addressed. It is just being done as a way of trying to scare the public from signing up on the Web site, which is so unfortunate because people want to sign up. They shouldn't be in fear that, if they sign up, somehow there is going to be a security breach.

I reserve the balance of my time.

Mr. Speaker, I yield such time as he may consume to the gentleman from California (Mr. Waxman), ranking member of the Energy and Commerce Committee.

Mr. Speaker, I yield such time as he may consume to Mr. Waxman.

Mr. Speaker, I yield 2 minutes to the gentleman from New York (Mr. Crowley), the vice chair of the Democratic Caucus.

Mr. Speaker, I yield 3 minutes to the gentlewoman from Texas (Ms. Sheila Jackson Lee).

I yield an additional 1 minute to the gentlewoman.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, once again I hear my colleagues on the other side repeating the same things that are not accurate. You do not have to go on healthcare.gov to sign up for health insurance. Mr. Waxman said you can go to a private insurance broker or call an 800 number. You can go through various nonprofits. They keep repeating the same thing, and we keep having to say that there have been no breaches.

The gentleman mentioned the administration. The administration statement, which I read before and I will only summarize part of it now, it says that the Federal Government has already put in place an effective and efficient system for securing personally identifiable information in the health insurance marketplace. The administration opposes the bill because it would create unrealistic and costly paperwork requirements that do not improve the safety or security of personally identifiable information in the health insurance marketplace. The purpose of the bill I understand; but it is simply not necessary, and it is just making people fearful of signing up.

I reserve the balance of my time.

Mr. Speaker, I continue to reserve the balance of my time.

Mr. Speaker, I just want to say, again, I am not saying that I am opposed to some kind of security notification. In fact, it already exists and there is a protocol in place with the Department of Health and Human Services. The point is that this Republican bill is simply not necessary. That security already exists.

The fact of the matter is there have not been any security breaches. Once again, we are simply seeing the Republicans get up and try to scare people so that they don't go and use healthcare.gov, the Web site.

What we would really like to see, Mr. Speaker, is the day when, on both sides of the aisle here, we can simply get up and talk about legislation that continues to provide outreach and encourage people to sign up for the Web site and get the health insurance that they need. I still honestly believe that most Republicans and Democrats collectively would like to see most Americans covered with health insurance. That was the purpose of the Affordable Care Act.

I think my one optimistic note today could be at least we are not seeing another bill on the floor that would seek to repeal the Affordable Care Act. Hopefully, that is some recognition on the Republican side that the Affordable

Care Act is actually accomplishing its goal of trying to cover most Americans, if not all Americans.

With that, Mr. Speaker, I urge my colleagues to oppose this unnecessary bill, and I yield back the balance of my time.

Mr. Speaker, on that I demand the yeas and nays.

Mr. Speaker, the majority has passed so few bills into law that it is on pace to become the least-productive Congress in history. And, frankly, I think they are a little bit proud of that. The inability to govern is directly related to the closed legislative process the majority has pursued with vigor over the course of the last year.

At the beginning of the second session of the 113th Congress, the majority has practically shuttered the doors of every committee, save for the Rules Committee. It is a rare day when a bill proceeds through regular order from a committee of jurisdiction to the Rules Committee and down to the House floor. In fact, during the first session of the 113th Congress, major legislation repeatedly originated in the Rules Committee and was rushed to the House floor for an up-or-down vote.

Furthermore, during the first congressional session, the majority relied upon closed rules to shut out the minority and diminish the chance of any compromise. Under a closed rule, no amendments are allowed on the House floor. That cuts out, Mr. Speaker, more than half of the people in the United States of America who voted for Democrats.

During 2013, the majority set new records by approving 19 closed rules in a single week and an unprecedented 11 closed rules in a single day. Even those with no interest in, or knowledge of, the legislative process can understand the impact that such a closed process has on our ability to govern.

Every Member of this Chamber was sent here with a simple duty--to represent our constituents to the best of our ability. But, by closing down the legislative process, the majority is preventing 200 duly elected Members of Congress from being able to do just that. Collectively, we members of the minority represent more than 142 million Americans. Each one of us is entrusted to work on their behalf. How can we do that when the majority takes away our ability to participate in marking up legislation, amending bills, and having a full and open debate?

The Rules Committee has the unique and powerful ability to open up the legislative process and get Congress working again. In our committee, we can amend bills, improve legislation, and set the terms of debate so every Member of the House can participate in the legislative process. That is why I am so dismayed and somewhat disgusted at the proposed rule the Rules Committee has carried to the floor today.

Before us is a single resolution for three bills. Under this resolution, two of those bills are considered under closed rules, which are not amendable, not discussable, and one is considered under a structured rule. And that one came up 2 days ago. It has had no committee action whatsoever.

The bill being considered under a structured rule tries to revoke virtually all regulatory powers from the EPA, the agency that protects our health, our rivers, our air, and our land.

At the same time, one of the bills being considered under a closed rule adds layers of red tape to the Department of Health and Human Services and demands that health care navigators provide everything but their blood type and family history to Congress on an almost daily basis. It is simply designed to slow up the work of signing up Americans for the health care that they want and deserve.

It is very clear this bill is not a serious attempt to serve the American people but is a tactic to keep health care navigators from doing their work. Instead of moving forward with these go-nowhere bills, we should be extending unemployment insurance to the millions of Americans struggling to find work. And without unemployment insurance, the economy is suffering every single day.

Just before we left for Christmas, the last day we were here, to end the debate on the rule of the budget, we had a vote that we could have done to extend the unemployment during the rules debate on the floor. That was under the previous question. The vote failed despite the fact that every Democrat and a Republican voted for it.

By the way, this bill was paid for. It was already taken care of by excess payments that we pay in agriculture subsidies. It was an extension for 3 months, but that was not good enough. So today, you are going to have another chance to do just that, to extend the unemployment insurance, and I strongly urge my colleagues to do it.

If my colleagues will join me in voting ``no'' on the previous question, a 3-month extension of unemployment benefits will come to the floor for an immediate vote. This is the same bipartisan bill that is moving forward in the Senate, and it deserves the same consideration here in the House.

Today, more than 1.3 million Americans and their families have lost access to unemployment insurance. Soon, it will be over 2 million and, by probably the end of March or May, 5 million. For so many, it is their only source of income and the only way they can pay their heating bills and buy food during these cold winter days.

We have to stand up for the millions of Americans struggling to get by through no fault of their own, because, you remember, in order to be eligible for unemployment insurance, you have to prove that you are looking for work. So I strongly urge my colleagues to vote ``no'' on the previous question when it comes up so we can have an immediate vote to extend unemployment insurance and finally do something in this House and through this Rules Committee that will benefit Americans and make our constituents know that we count for something.

Mr. Speaker, The Majority has passed so few bills into law that it is on pace to become the least productive Congress in history. This inability to govern is directly related to the closed legislative process that the Majority has pursued with vigor over the course of the last year.

At the beginning of the 2nd Session of the 113th Congress, the Majority has practically shuttered the doors of every committee, save for the Rules Committee. It is a rare day when a bill proceeds through regular order--from a committee of jurisdiction to the Rules Committee and down to the House Floor. In fact, during the first session of the 113th Congress, major legislation repeatedly originated in the Rules Committee and was rushed to the House Floor for an up or down vote.

Furthermore, during the first Congressional session, the Majority relied upon closed rules to shut out the Minority and diminish the chance for compromise.

Under a closed rule, no amendments are allowed on the House Floor. During 2013, the Majority set new records by approving 19 closed rules in a single week and an unprecedented 11 closed rules in a single day!

Even those with no interest in, or knowledge of, the legislative process can understand the impact that such a closed process has on our ability to govern.

Every member of this chamber was sent here with a simple duty: to represent our constituents to the best of our ability.

Yet by closing down the legislative process, the Majority is preventing 200 duly elected Members of Congress from doing just that.

Collectively, we members of the Minority represent more than 142 million Americans. Each one of us has been entrusted to work on their behalf. How can we do that when the Majority takes away our ability to participate in marking up legislation, amending bills and having a full and open debate?

The Rules Committee has the unique and powerful ability to open up the legislative process and get Congress working again. In our committee we can amend bills, improve legislation, and set the terms of debate so that every Member of the House can participate in the legislative process.

That is why I am so dismayed at the proposed rule that the Majority in the Rules Committee has carried to the Floor today. Before us is a single resolution for three bills. Under this resolution, two bills will be considered

under closed rules and one will be considered under a structured rule.

The bill being considered under a structured rule tries to revoke virtually all regulatory powers from the EPA--the agency that protects our health, our rivers and our land.

At the same time, one of the bills being considered under a closed rule adds layers of red tape to the Department of Health and Human Services, and demands that healthcare navigators provide everything but their blood type and family history to Congress on an almost daily basis.

It is clear that this bill is not a serious attempt to serve the American people, but a tactic to keep healthcare navigators from providing millions of Americans with access to healthcare.

Instead of moving forward with these go-nowhere bills, we should be extending unemployment insurance to millions of Americans who are still struggling to find work.

Just before we left for Christmas, we had a vote on extending unemployment during a rules debate on the floor. That vote failed, despite the fact that every Democrat voted for it. As a result, more than 1.3 million Americans lost unemployment insurance on December 28th.

Today, we will give this chamber another chance to extend unemployment insurance--and I strongly urge my colleagues in doing just that.

If my colleagues will join me in voting ``no'' on the previous question, a 3-month extension of unemployment benefits will come to the floor for an immediate vote. This is the same bipartisan bill that is moving forward in the Senate, and it deserves the same consideration here in the House.

Right now, more than 1.3 million Americans have lost access to unemployment insurance in the last few weeks. For many, it is their only source of income and the only way they can pay their heating bills and stay warm during these cold winter days.

We must stand up for the millions of Americans who are struggling to get by in these tough economic times. I strongly urge my colleagues to vote ``no'' on the previous question so that we have an immediate vote to extend unemployment insurance and finally provide for the millions of Americans in need.