H.Res. 455

I thank the distinguished gentleman, and I thank the manager of this legislation, and I thank the good intentions of our colleagues.

I want to pause for a moment, Mr. Pallone, and just simply say that although these are important issues, as a member of the House Judiciary Committee, I helped draft the PATRIOT Act and business record 215, and we are now looking to constrain the collection of mega-data, and I accept the importance of privacy for the American people. But I pause for just a moment to ask my colleagues, we have enough time today to actually pass the extension of the unemployment benefits. There are 1.3 million people, 12,000 in my own community, who would like us to stay here and make sure that we get that done. I hope that my friends on the other side of the aisle will accept the challenge of Republicans putting an extension of the unemployment benefits on the floor to help unemployed Americans.

But this is an important issue as well, and I do want to say that our friends have not documented any breach on personal and private data of those individuals that have accessed the Affordable Care Act, which are 9 million plus, and growing. We have had 46 votes to repeal it. Now we come one by one with legislation that has not gone through regular order. It has not gone through the committee process. It has very good intentions; but, in actuality, it may be overly burdensome because, Mr. Speaker, there is no bar. There is no limit for HHS to provide notice for any possible breach within seconds or minutes or hours after the incident may have occurred.

Frankly, this legislation doesn't go far enough. Let me give you a few facts. The Affordable Care Act implementation of healthcare.gov is under the authority of HHS. HHS assigned the task for developing healthcare.gov to the agency's Center for Medicare and Medicaid Services. Under the Federal Privacy Act, all Federal agencies must draft regulations to protect personally identifiable information under their control.

The Federal Privacy Act was established by an act of Congress and concurrence of the executive branch to balance the government's need to maintain personal information on Americans with the right of individuals to be protected against unwarranted invasions of their privacy.

The Privacy Act came as a direct result of the work of the Church Committee following revelations that the government has routinely used records on citizens for political purposes to engage in surveillance or retaliatory activity. There were a series of laws

passed by Congress to protect the privacy of Americans.

Computer records management was of such grave concern to Members of Congress following investigations into disclosures that then-President Nixon had used his high office to seek out by means to exact retribution against political enemies by causing harm to careers, reputations as well as financial injury through IRS audits.

So we have had an intense interest since the report ``Records, Computers, and the Rights of Citizens'' was produced in 1973. HHS is chiefly responsible for why the United States became the first Nation in the world to draft a Federal privacy law. They know what to do. They developed the Code of Fair Information practices which have five principles, one of which says there must be no personal data recordkeeping systems whose very existence is secret, that is, to not use the data of people in the wrong way.

There is the CMS Policy for Privacy Act, and I offer this for the Record.

The baseline of my point is that HHS was at the core of developing privacy. There have been no known breaches. There is no bar for CMS and HHS to tell the American public or the individual immediately.

This bill will add burdensome requirements and may--it may--distract or take away from legal and lawful law enforcement investigations. I ask that we look at this together in a bipartisan manner. I believe in privacy. I hope we can work together, Mr. Pallone, and make this what it should be; but I think the American people are protected.

Mr. Speaker, I rise to speak on H.R. 3811, the Health Exchange Security and Transparency Act of 2014.

I would like to commend the author of the bill for the focus on privacy.

Privacy protection is a policy area that has strong bi-partisan agreement.

However, because H.R. 3811 did not go through regular order there was no opportunity for the Committees of jurisdiction to provide valuable input into its drafting.

I would like to offer a few facts that may make it clear that this bill, although well intentioned is not necessary in its current form.

The Affordable Care Act implementation of healthcare.gov is under the authority of the Department of Health and Human Services (HHS).

HHS assigned the task for developing healthcare.gov to the agency's Centers for Medicare & Medicaid Services (CMS).

Under the Federal Privacy Act all federal agencies must draft regulations to protect personally identifiable information under their control.

The Federal Privacy Act was established by an act of Congress and concurrence of the Executive Branch to balance the Government's need to maintain personal information on Americans with the right of individuals to be protected against unwarranted invasions of their privacy.

The Privacy Act came as a direct result of the work of the Church Committee following revelations that the government had routinely used records on citizens for political purposes to engage in surveillance or retaliatory activity a series of laws were passed by Congress to protect the privacy of Americans.

Computer records management was of such grave concern to members of Congress following investigations into disclosures that then President Nixon had used his high office to seek out means to exact retribution against political enemies by causing harm to careers, reputations as well as financial injury through IRS audits.

In 1973, a report ``Records, Computers, and the Rights of Citizens'' was produced by the former Federal Department of Health Education and Welfare (HEW), which today exists as two agencies one of which is the Department of Health and Human Services (HHS) established the first federal agency privacy policies for information held on Americans.

HHS is chiefly responsible for why the United States became the first nation in the world to draft a federal privacy law.

HHS developed the Code of Fair Information practices which later became the basis for the Federal Privacy Act.

The Code of Fair Information Practices has five principles:

There must be no personal data record-keeping systems whose very existence is secret.

There must be a way for a person to find out what information about the person is in a record and how it is used.

There must be a way for a person to prevent information about the person that was obtained for one purpose from being used or made available for other purposes without the person's consent.

There must be a way for a person to correct or amend a record of identifiable information about the person.

Any organization creating, maintaining, using, or disseminating records of identifiable personal data must assure the reliability of the data for their intended use and must take precautions to prevent misuses of the data.

The Federal Privacy Act protects all personal information managed by Federal agencies.

We know that not all agencies do a good job at protecting the personal information of citizens so today's focus on privacy is relevant and important.

However, our focus should be much broader and better informed regarding the work of each agency in this area.

Committee hearings would have been beneficial in informing the drafters of H.R. 3811, prior to its introduction on the Floor of the House for a vote.

For example, authors of the bill may have taken a different approach if it was acknowledged that the CMS has several policy documents specific to the topic of protecting personal identifiable information of medical records data:

CMS Policy for Privacy Act Implementation & Breach Notification (7/ 23/07)

Risk Management Handbook Volume III Standard 7.1 (12/6/12)

Incident Handling and Breach Notification

CMS Privacy Policy is written to meet obligations established by the Federal Privacy Act of 1974 (5 U.S.C., 552a), the Computer Matching and Privacy Protection Act of 1988 (Public Law 100-503) and the Department of Health and Human Services Privacy Act Regulations (45 C.F.R. Part 5b).

I want to assure my colleagues that under the Federal Privacy Act all Federal agencies must ``develop an effective response to [breaches] that requires disclosure of information regarding the breach to those individuals affected by it, as well as to persons and entities in a position to cooperate, either by assisting in notification to affected individuals or playing a role in preventing or minimizing harms from the breach.''

All agencies, which include CMS, must report all incidents involving personally identifiable information to US-Computer Readiness Team or (US-CERT).

The US-CERT reporting requirement does not distinguish between potential and confirmed breaches--all must be reported within 1 hour of discovery/detection.

The CMS policy on breach notification has 5 criteria to determine if a breach has occurred:

Nature of the Data Elements Breached

Number of Individuals Affected

Likelihood the Information is Accessible and Usable

Likelihood the Breach May Lead to Harm

Ability of the Agency to Mitigate the Risk of Harm

CMS is directed to provide notification without unreasonable delay following the discovery of a breach, consistent with the needs of law enforcement and any measures necessary for CMS to determine the scope of the breach and, if necessary, to restore the integrity of the computerized system.

The consideration of Law-enforcement in government agency breaches is very important because this type of crime can take place in seconds or it may occur over hours, days, weeks or months.

Law-enforcement in investigation of data breaches attempts to identify the culprit(s) and others who may be involved.

To avoid impeding the efforts of law-enforcement or national security H.R. 3811, the Health Exchange Security and Transparency Act of 2014 should have included a law-enforcement exception.

Responsibility for information on individuals whose personally identifiable information has been breached is the CMS Administrator the highest official of the agency.

However, if the data breach is under 50, the notice may also be issued by the CMS Chief Information Officer or Senior Official for Privacy.

CMS Breach Notification to individuals must be in writing that should be ``concise, conspicuous, and in plain language'' and include the following:

Brief description of what happened, including date(s) and its discovery;

Description of the types of information involved in the breach;

Whether the information was encrypted or protected by other means when determined the information may be useful or compromise the security of the system;

What steps individuals should take to protect themselves from potential harm;

What the agency is doing; and

Who affected individuals should contact

There is no evidence that healthcare.gov had a breach of personal information.

If such a breach had occurred it would not be secret and members of this body would have been briefed.

First, the most important rule for cyber security is following the example of the professionals who work in this fast paced area: truth comes before beauty. The truth is that there is no computer system that is 100 percent secure from hostile cyber attacks, natural disasters, structural failures or human errors.

Second, the Internet is a rough neighborhood--the best we can do is to design the best systems possible provide the resources necessary to follow through on good security and privacy designs and ignore the politics of the moment. The most dangerous threats to cyber security do not care about anyone's political party they may care very much about your nation of origin.

Third, cyber security is not about the 14 year old with a laptop, but the botnet attack from a coordinate effort that brings to the discussion significant threats to networks. There is no evidence that nothing occurred that would suggest that the website experienced anything of this nature.

Congress should use regular order to consider means and methods of securing all federal data that is categorized as personally identifiable information.

Attempts to misinform or frighten Americans regarding the healthcare.gov or the Patient Protection and Affordable Care Act implementation mechanisms are unwarranted.

CMS has a detailed and well managed program for ensuring that personally identifiable information is secure and when questions arise they have a top level ``Incident Handling'' protocol that is through in investigating issues and uncovering the facts regarding suspected breaches.

CMS relies upon US-CERT, which is part of DHS' National Cybersecurity and Communications Integration Center (NCCIC) to address breaches of data it manages.

The Department of Homeland Security's United States Computer Emergency Readiness Team (US-CERT) leads efforts to improve the nation's cybersecurity posture, coordinate cyber information sharing, and proactively manage cyber risks to the Nation while protecting the constitutional rights of Americans.

CMS informs US-CERT within an hour of a suspected breach incident.

However, a report does not mean that an incident occurred an investigation must proceed to determine if the report is valid.

It is important note that premature breach notices being sent to consumers regarding their personally identifiable information could have unintended and adverse outcomes for several reasons:

Notice fatigue--too many notices and people stop paying attention;

Increased cost of administering a program due to additional communications that inform people that the initial breach notice was a false alarm;

Giving notice to cyber criminals or terrorists that they have been discovered before law enforcement or national security can assess how the extent of the threat, the target or objective of the attack and trace the source of the threat with the goal of identifying the culprits; and

Correcting the problem that allowed the breach to occur

HHS should only collect the personally identifiable information that is necessary, used it for the purpose of the collection and promptly discarded that data so no database or system of records is created.

I commend my colleagues for the focus on Privacy and hope that we can work together to improve the protection of personal information on Americans throughout the Federal Government.

I strongly recommend that my colleagues vote to send this bill back for committee consideration so that its goal of improving privacy protection can be better matched to the reality of what CMS is currently doing in the area of breach notification, which conforms to what Americans need and law-enforcement as well as national security must have to protect federal agency computer networks.

1 Introduction

CMS must be able to respond to computer security-related

and/or privacy-related incidents in a manner that protects

its own information and helps to protect the information of

others that might be affected by the incident.

This Risk Management Handbook Volume III, Standard 7.1,

Incident Handling and Breach Notification standard, along

with the companion procedures of the RMH Volume II, Procedure

7.2, Incident Handling, supersedes the CMS Information

Security (IS) Incident Handling and Breach Analysis/

Notification Procedure dated December 3, 2010.

1.1 Background

1.1.1 SECURITY EVENT

A Security Event is an observable occurrence in a network

or system (e.g., known or suspected penetrations of

information Technology (IT) resources, probes, infections,

log reviews), or any occurrence that potentially could

threaten CMS data confidentiality, integrity, or

availability.

1.1.2 REPORTABLE EVENT

A Reportable Event is any activity or occurrence that

involves:

A matter that a reasonable person would consider a

violation of criminal, civil, or administrative laws

applicable to any Medicare contract or federal health care

program.

Integrity violations, including any known, probable, or

suspected violation of any Medicare contract term or

provision.

A matter considered to have an ``adverse'' impact on the IT

system/infrastructure or CMS data confidentiality, integrity,

or availability. Examples of specific events that should be

reported include (but are not limited to):

Unauthorized access to or use of sensitive data for illegal

purposes.

Unauthorized altering of data, programs, or hardware.

Loss of mission-essential data (i.e., patient, financial,

benefits, legal, etc.).

Environmental damage/disaster (greater than $10,000)

causing loss of IT services or data, or which may be less

than $10,000 in damage yet affect CMS' ability to continue

any day-to-day functions and operations.

Infection of sensitive systems, firmware, or software by

malicious code (i.e., Viruses, Worms and Trojan Horses,

etc.).

Perpetrated theft, fraud, vandalism, and other criminal

computer activity that did, or may, affect the organization's

capabilities to continue day-to-day functions and operations.

Telecommunications/network security violations, i.e.,

networks (including local area networks [LANs], metropolitan

area networks [MANs], and wide area networks [WANs]) that

experience service interruptions that cause an impact to an

indefinite number of end users.

Unauthorized access to data when in transmission over

communications media.

Loss of system availability affecting the ability of users

to perform the functions required to carry out day-to-day

responsibilities.

Root-level attacks on networking infrastructure, critical

systems, or large, multi-purpose, or dedicated servers.

Compromise (or disclosure of account access information) of

privileged accounts on computer systems.

Compromise (or disclosure of account access information) of

individual user accounts or desktop (single-user) systems.

Denial-of-service attacks on networking infrastructure and

systems.

Attacks launched on others from within organizational

boundaries or systems.

Scans of internal organizational systems originating from

the Internet or from within the organizational boundaries.

Any criminal act that may have been committed using

organizational systems or resources.

Disclosure of protected data, including paper disclosure,

email release, or inadvertent posting of data on a web site.

Suspected information-technology policy violation.

A Reportable Event may be the result of an isolated event

or a series of occurrences. Reportable Events under these

procedures include events that occur at CMS federal sites,

contractor/subcontractor sites/systems, consultants, vendors

or agents. If the Reportable Event results in an overpayment

relating to either Trust Fund payments or administrative

costs, the report must describe the overpayment with as much

specificity as possible, as of the time of the due date for

the submission of the report.

Security events that may consist of an observable

occurrence in a network or system (e.g., detected probes,

infections prevented, log reviews, etc.), that do not

threaten system integrity, are not considered Reportable

Events unless they may be reasonably associated with other

incidents, Reportable Events, or breaches. CMS categorizes

these events in a monthly report to the Department of Health

and Human Services (HHS) (hereafter referred to as the

``Department'' or ``HHS'') Cybersecurity Program as follows:

Malicious Code Prevented: Viruses were prevented and did

not cause any harm to any system.

Probes and Reconnaissance Scans Detected: Probes and scans

were detected but did not pose a serious threat to a CMS

system.

Inappropriate Usage: Misuse of computing resources by an

otherwise authorized individual.

Other: Cannot be categorized under any of the above and do

not threaten system integrity.

There are many events that may be flagged as inappropriate

use of resources, but reflect situations that do not fall

under the definitions associated with incidents, Reportable

Events, or breaches. In such cases, reporting should be made

through applicable contractual resources, or through

appropriate Federal Fraud, Waste, and Abuse reporting

channels.

1.1.3 PRIVACY INFORMATION

Privacy is the right of an individual to control their own

personal information, and not have it disclosed or used by

others without permission. At CMS, we are charged with

protecting other people's private information--that of every

citizen (or legal resident) beneficiary utilizing benefits

the vast Medicare/Medicaid program, as well as many

subsidiary programs.

Confidentiality is the obligation of another party to

respect privacy by protecting personal information they

receive, and preventing it from being used or disclosed

without the subject's knowledge and permission.

Again, at CMS we are charged with protecting the

confidentiality of other people's citizen-beneficiary

information. A breach of that confidentiality is not simply a

failure of a ``technical control'', it is a basic failure of

CMS to meet its obligation to protect the individual citizen.

Moreover, unlike the banking industry where financial

compensation is a readily-available remedy to a breach,

private medical information cannot be simply replaced with

something of ``similar value'', or by simply closing an

account, and opening a new (better protected) one. Once a

privacy breach occurs, the ramifications can be far-reaching

and long lasting--with no readily available ``patch'' to undo

the damage (we cannot simply replace one violated health

record with a brand new one.)

Security is the means used to protect the confidentiality

of personal information through physical, technical, and

administrative safeguards.

Privacy is the ``business objective'' of security. The core

of the relationship between information security and

information privacy lies in the fact that security, or lack

of it, is the determinant of the level of privacy that a

system or infrastructure can assure. If there is a breach of

computer security, it has a corresponding negative effect on

the confidentiality, integrity, and availability of the

information therein. Inadequate security leads directly to

loss of privacy. Therefore, if privacy is the ``business

objective'', then security is the ``functional requirements''

necessary for an IT system to meet those ``business

objectives''.

1.1.3.1 PERSONALLY IDENTIFIABLE INFORMATION (PII)

Personally Identifiable Information (PII) is information

which can be used to distinguish or trace an individual's

identity, such as their name, social security number,

biometric records, etc. alone, or when combined with other

personal or identifying information which is linked or

linkable to a specific individual, such as date and place of

birth, mother's maiden name, etc. PII also includes

individually identifiable health information as defined by

the Health Insurance Portability and Accountability Act

(HIPAA) of 1996, Privacy Rule (45 CFR Section 164.501. PII is

also often referred to as personally identifiable data or

individually identifiable information.

1.1.3.2. Protected Health Information (PHI)

Protected Health Information (PHI) is individually

identifiable health information held or transmitted by a

covered entity or its business associate, in any form or

media, whether electronic, paper, or oral.

Individually Identifiable Health Information is a subset of

health information, including demographic data collected

concerning an individual that:

Is created or received by a healthcare provider, health

plan, employer, or healthcare clearinghouse.

Relates to the past, present or future physical or mental

health or condition of an individual; the provision of

healthcare to an individual; or the past, present, or future

payment for the provision of healthcare to an individual, and

meets either of the following:

Identifies the individual.

There is a reasonable basis to believe the information can

be used to identify the individual.

The HIPAA Privacy Rule excludes from the definition of PHI

individually identifiable health information that is

maintained in education records covered by the Family

Educational Right and Privacy Act (as amended, 20 U.S.C.

1232g) and records described at 20 U.S.C. 1232g(a)(4)(B)(iv),

and employment records containing individually identifiable

health information that are held by a covered entity in its

role as an employer.

The HIPAA Privacy Rule covers PHI in any medium (including

paper) while the HIPAA Security Rule covers PHI in electronic

form (ePHI) only.

1.1.3.3 DE-IDENTIFIED HEALTH INFORMATION

With those definitions in place, what information (or data)

elements comprise PHI such that, if they were removed, the

above definition of individually identifiable health

information would not apply? The answer is in the HIPAA de-

identification use standard and its two implementation

specifications of the HIPAA Privacy Rule.

There are no restrictions on the use or disclosure of de-

identified health information. De-identified health

information neither identifies nor provides a reasonable

basis to identify an individual. There are two specifications

for de-identifying individually identifiable health

information; either: 1) a formal determination by a qualified

statistician; or 2) the removal of specified identifiers of

the individual and of the individual's relatives, household

members, and employers is required, and is adequate only if

the covered entity has no actual knowledge that the remaining

information could be used to identify the individual.

The following identifiers of the individual or of

relatives, employers, or household members of the individual

must be removed to achieve the safe harbor method of de-

identification:

1. Names

2. All geographic subdivisions smaller than a State,

including street address, city, county, precinct, zip code,

and their equivalent geocodes, except for the initial three

digits of a zip code if, according to the current publicly

available data from the Bureau of Census:

a. The geographic units formed by combining all zip codes

with the same three initial digits contains more than 20,000

people.

b. The initial three digits of a zip code for all such

geographic units containing 20,000 or fewer people is changed

to 000.

3. All elements of dates (except year) for dates directly

related to the individual, including birth date, admission

date, discharge date, date of death; and all ages over 89 and

all elements of dates (including year) indicative of such

age, except that such ages and elements may be aggregated

into a single category of age 90 or older.

4. Telephone numbers

5. Fax numbers

6. Electronic mail addresses

7. Social security numbers

8. Medical record numbers

9. Health plan beneficiary numbers

10. Account numbers

11. Certificate/license numbers

12. Vehicle identifiers and serial numbers, including

license plate numbers

13. Device identifiers and serial numbers

14. Web Universal Resource Locators (URLs)

15. Internet Protocol (IP) address numbers

16. Biometric identifiers, including finger and voiceprints

17. Full face photographic images and any comparable

images.

18. Any other unique identifying number, characteristic, or

code, except as permitted for re-identification purposes

provided certain conditions are met

In addition to the removal of the above-stated identifiers,

the covered entity may not have actual knowledge that the

remaining information could be used alone or in combination

with any other information to identify an individual who is

subject of the information.

Mr. Speaker, I ask unanimous consent that all Members may have 5 legislative days to revise and extend their remarks and to include extraneous material on H.R. 2279.

Mr. Chairman, I yield myself such time as I may consume.

Mr. Chairman, I am pleased to rise in support of the amendment to H.R. 2279, the Reducing Excessive Deadline Obligations, or REDO, Act of 2013, which also includes my legislation, H.R. 2226, the Federal and State Partnership for Environmental Protection Act, and Mr. Latta's bill, H.R. 2318, the Federal Facility Accountability Act of 2013.

Our goal with all three of these bills is to modernize some of the environmental laws that we oversee and make sure that the States are playing a significant role in implementing them. To do that, we began this Congress with a hearing on the role of the States in protecting the environment. State environmental protection officials shared their experience and expertise with us and helped us better understand the complex partnership between the States and the Federal Government as States implement Federal laws, such as the Solid Waste Disposal Act, and the EPA implements the Comprehensive

Environmental Response, Compensation, and Liability Act, or CERCLA or Superfund law, and the relation to State environmental protection laws.

Today we consider three bills that are a logical outgrowth of that discussion. The Reducing Excessive Deadline Obligations, or REDO, Act of 2013 would give EPA flexibility by correcting two arbitrary action deadlines that were written into the Solid Waste Disposal Act and CERCLA many years ago.

RCRA contains a mandate that EPA review and, if necessary, revise all RCRA regulations every 3 years. This deadline is unnecessary and unworkable in the face of the significant number of regulations that currently exist under RCRA.

The bill would allow the Administrator to review and, if necessary, revise regulations as she thinks appropriate. The bill would also lift an action deadline in CERCLA requiring EPA to identify, prior to 1984, classes of facilities for which to develop financial assurance regulations.

More than 30 years passed without action from the EPA to promulgate regulations regarding financial assurance. A lawsuit and court order finally prompted the EPA action just a few years ago.

In the meantime the States and other Federal agencies have long since acted, putting in place strong financial assurance requirements of their own. That is why the bill also provides that if EPA does get around to establishing Federal financial assurance regulations, the States requirements would not be preempted.

The bill also requires the EPA to gather information regarding the financial assurance programs of States and other Federal agencies and report to Congress regarding whether there is a need for additional regulations by the EPA.

Should the EPA determine there is a need for additional requirements, the bill ensures compliance with existing State or Federal requirements will count towards compliance with EPA's requirements.

The Federal Facility Accountability Act would bring the CERCLA waiver of sovereign immunity into conformity with the Solid Waste Disposal Act, and for that matter the Clean Air Act, by requiring that all Federal Superfund sites comply with the same State laws and regulations as a private entity. This is not a new concept.

Legislation has been introduced previously by my friends across the aisle to ensure that Federal agencies comply with all Federal and State environmental laws, including CERCLA.

In fact, the Federal Facilities Compliance Act of 1991 had the same goal: to make Federal facilities subject to all the same substantive and procedural requirements, including enforcement requirements and sanctions that State and local governments and private companies meet.

The Federal Facility Accountability Act applies the same policy to Federal facilities under CERCLA that already applies to Federal facilities under the Solid Waste Disposal Act. Some argue that if this bill becomes law it will change Federal agencies' spending by forcing them to comply with State laws and that CERCLA is different because it is retroactive and applies to prior actions of the Federal Government.

The Solid Waste Disposal Act often applies to past conduct. That's why there is a provision for ``corrective measures.'' In fact, the EPA has issued multiple guidance documents that describe how Federal agencies should harmonize RCRA and CERCLA with respect to cleanups of hazardous waste.

Past conduct, future conduct--the fairness principle is the same. The basic question is whether Federal agencies should comply with State environmental protection laws just as private companies and State and local agencies must do.

My bill, the Federal and State Partnership for Environment Protection Act, does exactly what the title implies and would go a long way toward making the States partners with the EPA in cleaning up hazardous waste sites.

CERCLA is implemented by the EPA, but often States are in the best position to understand the sites in their State. This bill would allow States to play a larger role in the CERCLA process in several ways. The bill would allow States to list a site that it believes needs to be on the National Priorities List every 5 years and would provide transparency to the States if they suggest a site for listing.

The bill would also allow States to be consulted before the EPA selects a remedial action.

States are on the front lines and understand at the ground level how to prioritize environmental actions within their States.

They often come up with innovative solutions that better fit the local problem. We heard examples of that in our hearing on the Role of the States in Protecting the Environment.

CERCLA is a key example of a statute passed more than 30 years ago that we can now update and strengthen the Federal-State partnership to get sites cleaned up.

Removing barriers to job creation imposed by Federal Government is a cornerstone in our governing philosophy. Cory Gardner, Bob Latta and I produced bills to ensure that the Federal Government reduces unnecessary red tape, the barriers to job creation, while still keeping our environment healthy. These important bills aim to improve the Federal and State relationship when dealing with hazardous waste.

With that, Mr. Chairman, I reserve the balance of my time.

Congress of the United States

House of Representatives.

Washington, DC, January 8, 2014.

Hon. Fred Upton,

Chairman, Committee on Energy and Commerce,

Rayburn House Office Building, Washington, DC.

Dear Chairman Upton, I am writing with respect to H.R.

2279, the ``Reducing Excessive Deadline Obligations Act of

2013.''

As you know, H.R. 2279 contains provisions within the

Committee on the Judiciary's Rule X jurisdiction. As a result

of your having consulted with the Committee and in order to

expedite the House's consideration of H.R. 2279, the

Committee on the Judiciary will not assert a jurisdictional

claim over this bill by seeking a sequential referral.

However, this is conditional on our mutual understanding and

agreement that doing so will in no way diminish or alter the

jurisdiction of the Committee on the Judiciary with respect

to the appointment of conferees or to any future

jurisdictional claim over the subject matters contained in

the bill or similar legislation.

I would appreciate a response to this letter confirming

this understanding with respect to H.R. 2279, and would ask

that a copy of our exchange of letters on this matter be

included in the Congressional Record during Floor

consideration of H.R. 2279.

Sincerely,

Bob Goodlatte,

Chairman.

Mr. Chairman, I am proud to yield 3 minutes to my colleague from Ohio (Mr. Latta).

Mr. Chairman, I have to respond, I think, briefly. I appreciate the ranking member's passion in addressing these issues, but we need to clear up what some of the facts actually are.

CBO has scored these bills and has come back and said that there are no significant cost increases associated with these. Furthermore, in regards to meeting with the Department of Justice and the Department of Defense, that meeting did occur, and the concerns that they raised were mainly around criminal liabilities for Federal employees, and that was addressed in the final legislation. So I'm not sure why we are still debating those issues.

At this time, I would like to yield 2 minutes to my colleague from Colorado (Mr. Gardner).

Mr. Chairman, I'm proud at this point to yield 3 minutes to my good friend from Pennsylvania (Mr. Meehan).

Mr. Chairman, I am pleased now to yield 5 minutes to the gentleman from Illinois (Mr. Shimkus), our chairman.

(Mr. SHIMKUS asked and was given permission to revise and extend his remarks.)

Mr. Chairman, just a couple of quick points of clarification.

My friend and colleague Mr. Tonko and I agree on many things, and we have a history of having worked together to hold the EPA to commonsense rules, and I appreciate that, but I need to clarify just a couple of quick things that my colleague mentioned.

From the Environmental Council of the States, I have before me a letter that I would like to enter into the Record stating that the Environmental Council of the States is writing to support many of the concepts included in this legislation, on all three pieces of this legislation.

And the other organization, the Association of State and Territorial Solid Waste Management Officials, they don't take positions on legislation; so no matter what the piece of legislation would be, if you call them, they are not going to take a position on it one way or another. That does not mean that they do not support this, but they simply don't take positions.

I wanted to make those clarifications for the Record.

I reserve the balance of my time.

ECOS, The Environmental

Council of the States,

Washington, DC, June 18, 2013.

Re ``CERCLA Bills'' H.R.s 2226, 2318, 2279

Hon. Fred Upton,

Chairman, Committee on Energy and Commerce, Rayburn House

Office Building, Washington, DC.

Hon. Henry Waxman,

Ranking Member, Committee on Energy and Commerce, Rayburn

House Office Building, Washington, DC.

Dear Congressmen: The Environmental Council of the States

(ECOS) is writing to support many of the concepts included in

H.R. 2226 The Federal and State Partnership for Environmental

Protection Act of 2013, H.R. 2318 The Federal Facility

Accountability Act of 2013 H.R. 2279, and The Reducing

Excessive Deadline Obligations Act of 2013.

As stated in our testimony at your hearing on May 17, ECOS

supports the expansion of ``consultation with states'' as

described in the bills. ECOS especially acknowledges that the

bills directly address concerns expressed by the States in

our ECOS Resolution on federal facilities operations under

RCRA and CERCLA (attached; see especially the bolded items).

ECOS is a non-partisan, non-profit organization of the

state environmental agencies and their leaders, who are our

members.

We ask that you include this letter in the record on this

matter. If there is anything else that ECOS can do to assist

you in this matter, please do not hesitate to ask.

Regards,

R. Steven Brown,

Executive Director.

Attachment.

Mr. Chairman, I continue to reserve the balance of my time.

Mr. Chairman, I yield myself such time as I may consume.

In closing, I want to go back and revisit just briefly some of the cost implications or the allegations of cost implications of today's legislation that we are considering.

CBO carefully analyzed all three of the bills that we are considering as part of H.R. 2279 today, and here is what they said:

CBO estimates that, in some cases, implementing this

legislation could affect the pace of discretionary spending

if priorities for cleanup activities change. However, CBO

expects that total costs to fulfill Federal responsibilities

under CERCLA would be little changed under this legislation.

That was directly from the CBO score for H.R. 2226.

Based on information from EPA, CBO expects that removing

the current requirement to review certain recommendations

every 3 years would reduce administrative costs. However,

some of those savings in administrative expenses would be

offset by spending on the new requirement to report to the

Congress any financial responsibility requirements. CBO

estimates that, on balance, implementing this legislation

would not have a significant net impact on spending that is

subject to appropriation over the 2014-2018 period. Enacting

H.R. 2279 would not affect direct spending or revenues.

That was directly from the CBO score for H.R. 2279.

CBO estimates that enacting this legislation could increase the pace of discretionary spending to the extent that Federal agencies accelerate spending

related to cleanup activities or pay additional fines and penalties imposed by the States. However, CBO expects that aggregate, long-term costs to fulfill Federal responsibilities under CERCLA would be little changed under the legislation.

In addition, H.R. 2318 could increase direct spending to the extent that fines and penalties were paid from the Treasury's Judgment Fund. However, CBO expects that any incremental spending from that fund would probably be insignificant. CBO estimates that any additional direct spending over the 2014-2023 period would be insignificant.

CBO goes on to say:

Enacting this legislation would not fundamentally change

the Federal Government's responsibility to comply with

CERCLA. According to the latest financial report of the

United States, the Federal Government's current environmental

remediation and waste disposal liabilities exceed $300

billion (under all environmental laws). Under current law,

Federal agencies, in particular the Departments of Defense

and Energy, currently spend billions of dollars each year

conducting cleanup activities under CERCLA, including

reimbursements to State agencies for related services they

provide. Based on information from Federal agencies and

industry representatives, CBO expects that enacting this

legislation could induce Federal agencies to accelerate their

compliance activities at some facilities--possibly changing

the timing of funding requests for certain projects. As a

result, H.R. 2318 might lead to greater compliance costs for

Federal facilities for the years immediately following

enactment, but the total long-term cost of compliance would

not change substantially.

I just wanted to make that point for the record.

Finally, I want to urge my colleagues not to be misled by my colleague's argument that this bill somehow prevents the EPA from enacting financial assurance requirements. It simply does not. More than 30 years passed before EPA complied with the requirements of CERCLA and started the process of developing financial assurance requirements. All this bill does is require the EPA to acknowledge the body of law developed by the States and other Federal agencies in the more than 30 years since the EPA has failed to act.

This legislation does not limit EPA from establishing Federal CERCLA financial responsibility requirements or from setting a minimum level of financial assurance that is required. H.R. 2279 merely ensures that existing State and Federal requirements can be used to meet those requirements where appropriate and ensures that existing State protections that may already exceed a new Federal minimum requirement will not be automatically voided.

The purpose of the provision in the bill requiring the EPA to report to Congress before new CERCLA financial responsibility requirements are enacted is to make sure that there is a legitimate need for new requirements. It does not prevent the EPA from promulgating new requirements if they are necessary.

My colleague argues that the bill is based on a false premise that States are implementing adequate financial assurance requirements. The bill does not prejudge State financial assurance requirements. What the bill does is require the EPA to analyze the existing financial assurance requirements, and it directs the EPA to ``fill the gap'' left by financial assurance regulations developed by the States or other Federal agencies. But make no mistake, if there is a regulatory gap and the EPA believes that gap needs to be filled, the EPA is free to enact regulations.

The purpose of financial assurance under 108(b) of CERCLA was to prevent the creation of new Superfund sites. The bill provides a mechanism for gathering information to decide whether the existing State and Federal financial assurance requirements are adequate to protect the Federal Government from incurring response costs under

Mr. Chairman, I rise in opposition to the amendment.

Mr. Chairman, this amendment strikes the provision that would allow States to list a site on the National Priorities List once every 5 years.

States have a great deal of experience and expertise in cleaning up sites contaminated by hazardous wastes, and States are often in a better position to understand the realities of site cleanup in their States and to understand the local or regional issues affecting the cleanup, but there are times when it would be better addressed by the EPA under CERCLA, and there would be a significant delay in the listing process. As a result, the bill also allows a State to designate a site that meets the criteria for listing to the National Priorities List once every 5 years.

CERCLA currently permits States to list a site on the National Priorities List only once. States have taken to calling this their ``silver bullet.'' Using the silver bullet fast-tracks the listing of a site on the NPL and allows States to avoid the often lengthy listing process. Some States have already used their silver bullet, while others hold onto it and wait for a site that it believes would be better addressed by the EPA under CERCLA.

My colleague indicated in a Dear Colleague letter she circulated earlier today that the bill could result in the EPA's placing silver bullet projects at the bottom of the priorities list while still remaining in statutory compliance. While I appreciate my colleague's concern, this statement is both misleading and incorrect. The reality is that the EPA can place a silver bullet site--or any other site for that matter--at the bottom of its priority list at any time. This bill does not change the EPA's ability to prioritize sites for cleanup.

CERCLA is very process heavy, and States are often reluctant to wade into the drawn-out CERCLA process. They would rather clean up the sites themselves and avoid the stigma associated with having a Superfund site in their States. However, there are times when the only way to get a site cleaned up is to get it on the Superfund list. It is not an easy conclusion for States to come to, and States are not clamoring to list on the National Priorities List. So any argument that this bill would somehow result in an onslaught of new listings by the States would simply not play out.

One of the arguments against allowing States to list a site on the NPL is that it will somehow change the EPA's prioritization of how to spend its cleanup dollars. Just because a site is listed on the NPL does not mean that it will automatically receive funding or will somehow jump to the front of the line to receive cleanup dollars. Nothing in this bill changes the fact that the EPA sets the priority for sites to be cleaned up, and the EPA decides how to spend its cleanup dollars.

Furthermore, if a site is listed and is being cleaned up using Federal dollars, States are financially invested in making sure the cleanup is done right. States must contribute 10 percent of the overall remedial cost and all of the long-term operation and maintenance costs. With that, I urge my colleagues to oppose this amendment.

Mr. Chair, I reserve the balance of my time.

Mr. Chairman, ironically, the EPA often pushes States to identify more sites that the EPA can put on the list so that the EPA can argue for more cleanup funding. The EPA incentivizes States to identify sites that meet the listing criteria by giving the States that identify sites more funds to do initial site assessments.

So the long and short of it is that the EPA wants more sites on the NPL, and the EPA wants the States to assist with identifying NPL sites, but the EPA does not want to relinquish control over the actual selection of the appropriate sites. We are trying to help fix that. Again, I urge a ``no'' vote from my colleagues on the Sinema amendment.

With that, I yield back the balance of my time.

Mr. Chairman, I am sure my colleague's amendment is well-intentioned, and in fact, I agree with him. I do not want to see an increase in litigation or a slowdown in the cleanup process or a decrease in funds available to clean up Superfund sites, but this amendment is not necessary because H.R. 2279 will not do any of those things.

CERCLA has been implemented for over 30 years, and the EPA has developed many practices and policies during that time. Some of the policies work and are consistently implemented, but many of the policies or practices are ineffective or are not consistently applied across the EPA regions. The EPA has done a good job of getting contaminated sites cleaned up under CERCLA, but that doesn't mean that we can't do better.

States are often in a better position to understand the local and regional issues affecting the cleanup, and States are well positioned to assist the EPA with all aspects of a response action. By ensuring that the States have a meaningful role in the Federal-State partnership under CERCLA and by making sure that Federal entities are on a level playing field with private entities engaged in CERCLA cleanups, we can do better and get more sites cleaned up faster.

My colleague's amendment implies that the purpose of this bill is to thwart cleanup efforts. On the contrary, the purpose of this legislation is to make sure sites get cleaned up in a

timely fashion by enhancing the existing role of the States, which are in the best position to assess the conditions at the site. The bill adjusts a top-down culture of CERCLA cleanups, but the bill does not alter the EPA's lead role in implementing CERCLA. States are already involved in the CERCLA process. Ensuring that States have a meaningful and substantial role will not slow down the cleanup process.

My colleague's amendment also implies that H.R. 2279 will reduce the number of funds available for cleanup. This is simply not the case. Congress decides on the amount of money to be appropriated to the EPA or to other Federal agencies for cleanups, and that is not changed by this legislation. It is up to the Federal agencies to prioritize how they spend the appropriated cleanup funds, and nothing in this bill changes the way money appropriated for cleanups is spent.

With that, I reserve the balance of my time.

Mr. Chairman, once again, I want to say how much I respect my colleague, Mr. Tonko. We continue to work together, have worked together, and have had some successes in holding the EPA accountable to the law. I appreciate working with him.

But this amendment, although well-intentioned, is drafted in such a way that makes it impossibly vague. It is indeterminable whether a provision of the bill would increase the potential for litigation, and I continue to urge my colleagues to vote ``no'' on the Tonko amendment.

With that, I yield back the balance of my time.

Mr. Speaker, I rise in opposition to the motion.

Mr. Speaker, our goal with this legislation is clear and straightforward. We want to modernize outdated environmental laws. The part of the bill that the gentleman from Colorado (Mr. Gardner) wrote makes modest, but important, improvements in environmental law. It allows the EPA to review and revise its solid waste disposal regulations as necessary.

In a hearing that we had, we asked a mayor from New Jersey, Would you rather clean up the trash or revise regulations? The mayor made it clear he would rather focus on getting the real work done instead of getting bogged down in governmental red tape.

The part of the bill written by the gentleman from Ohio (Mr. Latta) says that Federal facilities should behave like anyone else in the State and meet the same natural resource protection requirements. Now, go figure: requiring the Federal Government to live under the same laws that the American people, the States and private-sector businesses have to live under. This is not a new concept. It is already the case under the Clean Air Act and RCRA. Let's just narrow the gap for the Superfund.

Finally, the portion that I wrote ensures that States have a place at the discussion table throughout the process that the EPA set for developing remediation plans.

I urge a ``no'' vote on the motion to recommit and a ``yes'' on final passage. With that, I yield back the balance of my time.

Mr. Speaker, by direction of the Committee on Rules, I call up House Resolution 455 and ask for its immediate consideration.

Mr. Speaker, for the purpose of debate only, I yield the customary 30 minutes to gentleman from Colorado (Mr. Polis), pending which I yield myself such time as I may consume. During consideration of this resolution, all time yielded is for the purpose of debate only.

General Leave

Mr. Speaker, I ask unanimous consent that all Members have 5 legislative days to revise and extend their remarks.

Mr. Speaker, House Resolution 455 provides for the consideration of three important bills which were reported by the Energy and Commerce Committee: H.R. 2279, the Reducing Excessive Deadline Obligations Act of 2013; H.R. 3362, the Exchange Information Disclosure Act; and H.R. 3811, the Health Exchange Security and Transparency Act of 2014.

H.R. 2279 is a bill to address the burdensome and outdated deadlines for certain rulemaking activities conducted by the Environmental Protection Agency under the Solid Waste Disposal Act and the Comprehensive Environmental Response, Compensation, and Liability Act. This provides flexibility for the Environmental Protection Agency in order to streamline a process critical to cleaning up sites contaminated with certain toxic or hazardous chemicals.

It further requires the Environmental Protection Agency to evaluate existing State or other Federal financial insurance requirements to determine whether additional requirements are, in fact, necessary.

Finally, it requires the owner or operator of a chemical storage site to report the presence of such chemicals to the State emergency response commissions.

It is a commonsense piece of legislation to help clean up areas that have been polluted and allows for their reclamation or development. This could bring jobs and economic benefits to neighborhoods which have been so affected.

As the two health care-related pieces of legislation, these are targeted bills to address just a few of the massive problems the American public has witnessed over the last few months pertaining to the calamitous rollout of the Federal www.healthcare.gov Web site. The data obtained by www.healthcare.gov is one of the largest collections of personal information ever assembled. It links information between seven different Federal agencies, State agencies, and government contractors.

In promising lower costs and widespread health coverage for Americans, President Obama failed to mention that the Affordable Care Act's mandates and requirements will create large-scale disruption of the entire health insurance market. The resulting cancelation of insurance plans and high cost for employers to continue providing insurance for their workers has left millions of Americans with no choice other than to purchase health insurance through the Affordable Care Act's exchanges, subjecting their personal information to the vulnerable security infrastructure.

The initial launch of www.healthcare.gov on October 1, 2013, was plagued with glitches and errors. Not only did the administration fail to establish basic functionality of the Web site, but the initial problems really only break the surface of the deeper security threats in the underlying law. A multitude of gaps remain in the Web site's security infrastructure, making the Web site a wide-open target for hackers and identity thieves. These flaws continue to pose a threat to the security of Americans' personal data.

Mr. Speaker, it wasn't that the administration was not alerted to these security concerns on the Web site prior to the launch. MITRE Corporation, a contractor for the Department of Health and Human Services, alerted the agency that 19 unaddressed security vulnerabilities plagued the Web site prior to its launch on October 1. Top officials at the Centers for Medicare and Medicaid Services, including the chief information security officer, Teresa Fryer, along with the Web site's project manager, Tony Trenkle, both refused to sign the Authority to Operate license that was necessary to actually launch www.healthcare.gov. Despite these known issues, the director of the Centers for Medicare and Medicaid Services, Marilyn Tavenner, continued to launch the Web site.

This is much more than a faulty Web site. This is about the American people, who cannot trust their government to certify that their personal information will be safe on a government-run Web site.

The security threat goes beyond just an individual's primary application. Once an individual's personal information is entered into the system, the exchange has the ability to access information within the Department of Homeland Security, the Internal Revenue Service, Social Security, and the Treasury Department. The administration has opened numerous Federal agencies to data breaches and unauthorized access.

Just before the holidays, the entire Nation saw firsthand what a massive security breach looks like. Over 40 million Target customers, their personal data was compromised by computer hackers who pilfered personal financial information and identification.

Target has gone out of their way to alert customers of the security breach. Unfortunately, the Federal Government has no such obligation under the law. This is a point that I don't think most people are aware of. It is not required. It is not a mandate that you have a Target charge card or that you shop at Target, but it is certainly required and a mandate that you buy your insurance through www.healthcare.gov. This is a coercive Federal policy that now is pulling people into its Web site and refuses to provide them the very same protection that we demand that the private sector do for a voluntary purchase.

Instead of following the same requirements placed on the private sector, the Federal Government has gone out of their way to avoid imposing this basic due diligence in their own exchanges. Even when a notification requirement was specifically requested during the rulemaking process on the exchanges, the administration just simply refused.

In the March 27, 2012, Federal Register, Department of Health and Human Services responded, stating:

We do not plan to include the specific notification

procedures in the final rule. Consistent with this approach,

we did not include specific policies for investigation of

data breaches in this final rule.

Furthermore, State laws required that many of the 14 State-run insurance exchanges, that they do disclose such information. No such law exists for the federally run exchange. Mr. Speaker, I would remind you that 36

States rely upon the federally run exchange.

Look, we have spent hundreds of millions of dollars, taxpayer dollars. The American people deserve to know that their personal information is protected and to be notified if that protection lapses.

Let's be honest: www.healthcare.gov is the most talked about Web site in years. The massive amounts of personal information that is collected through www.healthcare.gov and its ability to access multiple government databases creates the perfect environment for targeting by hackers.

Over 16 attempts to hack into the system have already been reported, not to mention the many stories that have been reported in the press on the mishandling and sharing of individuals' data. Identity theft is a threat not only to an individual's credit rating and personal finances but also to overall United States security. Most Americans would be shocked to learn that this level of protection is not already in place for an initiative the size of the Affordable Care Act. Well, today the House is working to correct this injustice, protecting Americans when the administration has refused to do so.

The Obama administration has consistently refused to disclose detailed data on how many Americans have actually completed the Obama Care enrollment process. Now it is more than 3 months after the launch of the exchanges, and we just simply do not know how many Americans are enrolled in the exchange plan.

It was the administration who initially defined the success of the exchange as the number of Americans who actually enroll in the program. The number of enrollments are the only way to evaluate whether the more than $1 trillion that was spent on this thing by the administration is actually working.

The President's commitment to an open and transparent government, repeated so many times during the passage of the Affordable Care Act, represents yet one more broken promise in a long string of broken promises.

Where this administration has failed, the bill before us will require the Secretary of the Department of Health and Human Services to provide detailed weekly reports to the American people about the enrollment number on healthcare.gov. The American people deserve to know what they are getting for their hard-earned tax dollars that they have spent on the demands of this administration.

It is the American people who are suffering because of the mismanagement and failures of this administration. Today--today--we have the opportunity to provide transparency and protect Americans' personal information.

The rule before us today provides for 1 hour of debate equally divided between the majority and the minority for each of the bills contained in the rule. The minority is further afforded the customary motion to recommit on each piece of legislation.

I want to encourage my colleagues to vote ``yes'' on the rule and ``yes'' on the underlying bills and stand with the millions of Americans who are asking and who are demanding that we protect their privacy.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I now would like to yield 4 minutes to the gentleman from Georgia, Dr. Collins.

Mr. Speaker, may I inquire as to the time remaining?

Mr. Speaker, I yield myself 2 minutes.

Mr. Speaker, it is often said those who don't remember their history are doomed to repeat it.

The Rules Committee is an important function of this House. It is an important function of this body. Prior to 3 years ago, the Rules Committee was under the jurisdiction of the Democrats. They controlled the Rules Committee throughout the entirety of the 111th Congress. You may recall, that was the first 2 years of the first Obama term. In those 2 years under Speaker Pelosi, this was the first Congress in history--the first Congress in the history of the Republic--not to have a single bill considered under an open rule process.

Now, since Republicans resumed the majority at the beginning of 2011, 31 bills have come under an open rule. The track record may not be perfect, but it is inestimably better than what preceded it.

I reserve the balance of my time.

Mr. Speaker, I tire of going through this history lesson every time we come down to the floor, but may I remind you that when the now-Affordable Care Act was passed into law, this was a bill that came over to the House from the Senate. Sure enough, the House had sent the bill over to the Senate in July of 2009, H.R. 3590. It was a bill that dealt with housing. The bill that dealt with housing was amended. The amendment read, ``Strike all after the enacting clause and insert,'' and the health care language, which was de novo, the health care language was inserted.

Now, to be sure, the House had considered a health care reform bill, H.R. 3200. H.R. 3200 has gone to the ether of history. H.R. 3590 passed in the Senate, a 60-vote margin on Christmas Eve in 2009, and then was thrown over to the House of Representatives. Did we have a hearing on H.R. 3590 in the Committee on Energy and Commerce? No, we did not. Did they have a hearing in the appropriate subcommittee of Ways and Means on H.R. 3590, as amended? No, they did not.

The bill came to the Rules Committee. It came to the Rules Committee. I attempted to offer amendments. I was told, No, thank you. The bill was perfect the way it is, doesn't need any changes. This bill that affects every man, woman, and child in this country for the next three decades in a very unfavorable way was passed without any input from the then-minority, the Republicans in the House of Representatives.

So it is beyond comprehension that we can continue to have these arguments about closed processes. This, after all, is the granddaddy of all closed processes. And the consequence, the drafting errors, the problems embedded in the structure, could not be dealt with during the normal legislative process, which is why so much authority has been transferred to the executive branch, to the agencies, and why they are now essentially writing the laws that affect so many Americans.

I reserve the balance of my time.

Mr. Speaker, I yield myself 1 minute.

I would point out this bill before us today does not--does not-- change the Superfund, but it does allow States the flexibility to deal with problems in their States as they see fit.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I would like to inquire, does the gentleman have any other speakers? If not, I am prepared to close.

Mr. Speaker, I yield myself the balance of my time.

Mr. Speaker, one of the questions for people who have been watching this debate, I'm sure one of the questions that they have, is there any difference as to how the private sector is treated if and when a data breach occurs versus a Federal agency? The simple fact of the matter is there is a difference.

The private sector is governed under State laws and, yes, by some Federal regulations as well.

In fact, earlier this month, in a publication called The Hill, entitled, ``Target's data breach sparks calls for action,'' there was significant discussion about, perhaps, there being more activity on the part of the Federal Trade Commission in protecting consumers who have been exposed to a data breach.

What are the protections for people harmed with a data breach by the Federal Government?

In fact, for that, there is not legislation, there is not a law that was signed by any administration, but there is an executive order of the President's, dating from May 22, 2007, a so-called OMB Circular.

The OMB Circular dealing with data breaches under the section ``Timeliness of the Notification'' reads:

Agencies should provide notification without unreasonable

delay following the discovery of a breach, consistent with

the needs of law enforcement and national security and any

measures necessary for your agency to determine the scope of

the breach and, if applicable, to restore the reasonable

integrity of the computerized data system compromise.

Decisions to delay notification should be made by the agency

head.

You get the impression that this is, perhaps, a rather open-ended or diffuse or poorly defined timeliness of notification for our constituents who are harmed by a data breach by a Federal agency. So that is one of the problems that we are here today to correct.

Today's rule provides for the consideration of a critical jobs bill and critical security bills to clean up our environment and to protect Americans' personal data.

I certainly want to thank Mr. Gardner, Mr. Terry and Chairman Pitts for their thoughtful bills.

I urge my colleagues to support both the rule and the underlying pieces of legislation.

Mr. Speaker, I urge an ``aye'' vote on the previous question. I yield back the balance of my time, and I move the previous question on the resolution.

I yield myself such time as I may consume.

I thank the gentleman, Mr. Burgess, for yielding me the customary 30 minutes.

Mr. Speaker, I rise in opposition to the rule today under which three bills are being brought to the floor: H.R. 3811, the Health Exchange Security and Transparency Act; H.R. 2279, the Reducing Excessive Deadline Obligations Act; and H.R. 3362, the Exchange Information Disclosure Act. You wouldn't know by their names what those bills actually do. I discuss that, and, more importantly, I plan to discuss, Mr. Speaker, what these bills fail to accomplish.

These misguided and superfluous bills were brought under a very restrictive process. Two of them are being brought to the floor under a completely closed rule that blocks all efforts by Members to improve the legislation. Democrats yesterday on the Rules Committee proposed an open rule for these bills allowing Members from both sides of the aisle to offer their ideas to make them better, and it was voted down in the Rules Committee in a partisan vote.

Instead of moving forward and tackling challenges like extending unemployment, which has been talked about, or passing a jobs bill or an infrastructure bill or fixing our broken immigration system or reforming our tax system, again, we are discussing bills relating to the Affordable Care Act that don't seek to improve the act and make it work better for the American people but only add more paperwork and bureaucracy and cost to the health care system we already have by putting additional requirements on Federal workers and others that are working hard to ensure that ObamaCare works for America every day. Of the 112 legislative days we have left this year, we need to ensure that we spend them wisely, and I don't think that these three bills are a good way for us to use 2 days of our time.

The first bill, H.R. 3362, calls on HHS to publish weekly reports on consumer interactions with healthcare.gov, including the details of all calls received by the call center. Now, much of this information is already available monthly. There are already reliable updates on enrollment numbers and numerous updates on the Web sites and issues consumers have encountered. Look, while you are fixing the Web site and getting it working is not the time to put additional requirements on those that are laboring to ensure that Americans can sign up for affordable health care. Again, it is more information about who is calling and what they are doing weekly rather than monthly will provide an additional workload for those who are trying to make sure that the Web sites are functioning for America.

It will actually make it harder for the Web sites to function by having to divert some effort if this were to become law simply to building reporting requirements that were mandated by Congress. It is almost as if this bill was designed to make the Web site work worse, Mr. Speaker, by moving developers and others, without any additional resources, away from making the necessary improvements towards building entirely new reporting systems just so people can have information weekly instead of monthly.

It would be great, first of all, to have information weekly. I would love to have information daily. I would love to have information realtime. I used to run an Internet company. It would be wonderful to have that information. You have to weigh the costs and benefits and say, Is it worth building into this system realtime reporting? What are we forgoing by doing that? Is it worth it to say we want the information weekly instead of monthly?

Again, if you are building it from scratch and perhaps if the Republicans had offered this as an amendment into the original Affordable Care Act, maybe this could have been incorporated in 3 years ago and we could have built a system with either realtime or weekly reporting. But here where we are today, clearly the top priority needs to be that this Web site works well for the American people so they can get affordable health care for themselves and their family. That is what the American people want.

Now, let's talk about security and safeguards for consumer information. Again, you have the germ of a good idea. Of course, when the government has our personal information, we need to make sure that there are adequate safeguards. That goes for the IRS, it goes for military personnel files, and it goes for the Affordable Care Act, just as we want to make sure that when the private sector and companies have our personal information that they institute the proper safeguards. And there are examples of failure. Mr. Burgess mentioned Target as a private-sector example of failure.

We certainly hope that we have the infrastructure and security in place to ensure that there is not a failure of security with regard to the Affordable Care Act. But when we are talking about identity theft and how to address it, we need to look at where the real problem is. What is the leading cause of identity theft? Is it the IRS? Is it the Affordable Care Act? Is it the military? No. One of the biggest causes of breaches of personal information is our

broken immigration system, the fact that many immigrants in our country are here with fake paperwork, fraudulent Social Security numbers they have purchased or stolen--and H.R. 15, the bipartisan comprehensive immigration reform package, which in a very similar form has already passed the Senate, would address this.

So if we actually want to reduce identity theft and breaches of security and safeguard, Mr. Speaker, personal information for the American people, we should address the real problem rather than one of many hypothetical problems that, again, is no doubt worthy of discussion, but let's address where immigration--where identity theft actually occurs.

According to the Center for Immigration Studies, which has done a lot of work on identity theft from those who are here illegally, experts suggest that 75 percent of people who are here illegally and working use fraudulent Social Security cards to obtain employment. Again, Americans are the victims of this theft. Children are prime targets. Their report indicates that in Arizona it is estimated that there are thousands of children that are victims of identity theft. H.R. 15 contains mandatory E-Verify, which the Center for Immigration Studies says would curb and stop virtually 100 percent of child identity theft.

So, I mean, if we are serious, Mr. Speaker, about doing something about the fact that drivers licenses and Social Security numbers are being stolen, well, let's pass immigration reform. Let's make sure that people who are working in our country and have a role here have some kind of provisional work permit, some prospect of a pathway to citizenship over many years or decades, and that we have a mandatory E- Verify mechanism of checking, a way of verifying at the employer level that their paperwork is authentic and it is not, in fact, stolen from an innocent American, as it is today. So that would address identity theft. That would address fraud.

We have people today that actually, under our current laws, are incentivized to steal information--personal information--from American people. Our immigration system is clearly broken. We need to fix it. H.R. 15, the House's bipartisan, comprehensive immigration reform bill, would create a mandatory employment eligibility verification program. Currently, only 7 percent of employers in our entire country are enrolled in E-Verify to do workplace authentication of those who work here.

So, let's bring this bill to the floor if that is the issue we want to address rather than discuss something that is hypothetically of concern. Yes, of course, we care about secure information in the Affordable Care healthcare.gov site. We care about it in military records, and we care about it in the IRS. But, meanwhile, there are hundreds of thousands of identities being stolen every day, and that is going to continue because this body refuses to bring H.R. 15 to the floor of the House, which would make that number almost zero.

Mr. Speaker, the final bill that this rule brings to the floor is H.R. 2279, the Reducing Excessive Deadline Obligations Act. It is really a package of three bills that would weaken hazardous waste laws like Superfund and the Resource Conservation Recovery Act. It would actually limit the EPA's oversight to ensure that the American people are safe and healthy.

Do we need to remind this body that the reason Congress enacted these safeguards and Superfund is because of tragedies like Love Canal where a residential neighborhood was built on top of 22,000 tons of hazardous waste, and due to the exposure, the residents suffered very high rates of miscarriages, cancers, and birth defects? The situation was so dire that the Federal Government wound up having to evacuate the entire community. That is not the America I want to live in, Mr. Speaker. I oppose H.R. 2279 because it could lead to more situations like Love Canal rather than making sure that the American people are safe and healthy in their homes.

Mr. Speaker, this debate is not really about reporting requirements. It is about making healthcare.gov function less effectively. It is not really about breaches of our personal information. We can solve a big chunk of that by bringing H.R. 15 to the floor of the House. It is not really about improving our competitiveness by removing unnecessary EPA regulations. It is about risking the health of our families.

We need to focus on rebuilding our infrastructure, fixing our broken immigration system, and making sure that we can protect the health of the American people, not jeopardize it.

I reserve the balance of my time.

Mr. Speaker, again the gentleman said there is a risk of information being taken from the healthcare.gov site. There is potential risk from any site. But every day, there are tens of thousands of American identities being stolen because of this body's refusal to simply fix our broken immigration system now.

Mr. Speaker, I yield such time as she may consume to the gentlewoman from New York (Ms. Slaughter), the ranking member of the Rules Committee.

Mr. Speaker, I would remind the gentleman from Texas (Mr. Burgess) that this particular rule has two closed rules on two of the three bills.

With that, I yield 2 minutes to the gentlewoman from Texas (Ms. Jackson Lee).

I yield an additional 30 seconds to the gentlewoman from Texas (Ms. Jackson Lee).

Mr. Speaker, I yield 2 minutes to the gentleman from Virginia (Mr. Connolly).

Mr. Speaker, I yield an additional 30 seconds to the gentleman.

Mr. Speaker, on this 50th anniversary of the war on poverty, 1.4 million Americans have lost emergency unemployment insurance and thousands more stand to lose it each day, each week, that Congress fails to act. If we defeat the previous question, I will offer an amendment to the rule that will allow the House to consider legislation that is identical to the bipartisan measure being considered in the Senate and would restore unemployment insurance to those who have lost it.

Mr. Speaker, I yield 2 minutes to the gentleman from Michigan (Mr. Kildee), a leader in the effort to restore unemployment insurance, to discuss our proposal.

Mr. Speaker, I yield 3 minutes to the gentleman from Maryland (Mr. Hoyer), the Democratic whip.

Mr. Speaker, I yield 1 minute to the gentleman from Rhode Island (Mr. Cicilline).

I am prepared to close.

Mr. Speaker, I ask unanimous consent to insert the text of the amendment in the Record, along with extraneous material, immediately prior to the vote on the previous question.

Mr. Speaker, I urge my colleagues to vote ``no'' and defeat the previous question.

The Senate has passed a bipartisan, comprehensive immigration bill, and the Senate is debating unemployment insurance. Meanwhile, the House hasn't dedicated a single second of legislative floor time to any immigration reform bill that would address identity theft.

Let's move forward and pass bills that matter to the American people rather than political bills that aren't going anywhere.

I urge a ``no'' vote on the rule, and I yield back the balance of my time.

Mr. Speaker, on that I demand the yeas and nays.

Mr. Speaker, I demand a recorded vote.

Mr. Chair, I yield myself such time as I may consume.

At a time when too many of our citizens are still out of work, our Nation's infrastructure is in need of repair, the Tax Code needs revision, and when the safety net that provides basic necessities for our citizens has a tragic number of holes to close, we are spending our time on yet another bill that is headed straight for the legislative dust bin.

It was the high-profile contamination at Love Canal in my home State of New York back in 1978 that motivated Congress to address the serious public

health threat that existed at many sites across this country. Toxic contamination of air, of water, and of land from the improper handling of disposal of hazardous materials.

Many of us represent districts that have formerly contaminated sites or sites that still remain to be cleaned up.

Superfund is not a perfect law, but it has, in combination with other environmental laws, returned many abandoned, contaminated sites to productive use.

When contaminated, blighted land is transformed, the entire community benefits. A long-abandoned former industrial site along the riverfront in my district was restored to a popular park. The residents of Amsterdam now enjoy a beautiful waterfront area.

H.R. 2279 does nothing to improve public health or create jobs or protect the environment or avoid needless public expenses. In fact, it does the opposite.

Title I of this bill further delays actions that should have been taken years ago. Congress included broad authorities for the Environmental Protection Agency to ensure that businesses that handle hazardous substances were financially able to deal with contamination that might result from their activities. This provision remains essential to protecting taxpayer interests, and it ensures these businesses are acting responsibly.

EPA's goals within the Superfund program should not stop at cleaning up the legacy sites that we have. It should also prevent new sites from being contaminated. It should prevent more people from being exposed to toxic substances, and it should prevent the property damage, loss of revenue, and stigma that communities experience when they are marred by these sites.

H.R. 2279 blocks the Environmental Protection Agency from implementing financial responsibility standards that their inspector general's office and the Government Accountability Office have advised are prudent actions that will avoid unnecessary public expenditures to clean up contaminated sites.

The GAO's last report on this topic indicated that in the 10-year period they examined, Federal agencies spent $2.6 billion to reclaim abandoned hard-rock mine sites on Federal, State, private, and tribal lands.

So how does H.R. 2279 address this potential $100 million per year liability? By blocking EPA from taking recommended steps to avoid these potential cleanup costs. We cannot afford to continue this destructive policy.

Under the guise of ``fiscal responsibility,'' the majority voted to expand the list of requirements for applicants to the food stamp program to include drug testing and work requirements in addition to the detailed examination of an applicant's financial assets already required--all this to avoid providing a subsidy of about $1.50 per meal.

Apparently, it is too much to ask that a business, which could expose communities to toxic contamination, leave taxpayers with cleanup costs in the tens of millions of dollars, and result in lost local revenue and loss of property values, provide the government with assurance that it can afford to properly manage or clean up contamination that it created. The inconsistency in these policy choices is, indeed, incredible.

Blocking EPA from instituting basic requirements to protect public health, community vitality, local economic interests, and taxpayer interests provides a massive subsidy to a polluter at great public expense.

Titles II and III of this bill are somewhat of a mystery. I have no idea what problems with the Superfund program they propose to fix, but we have heard from the administration about serious problems this bill would, indeed, create.

The proponents of this legislation claim that title II will provide States more funding, give States a greater role in cleanups, and improve cooperation between States and the Federal Government on site cleanups, but States already have a significant role. Under current law, States can assert greater control over cleanups through a variety of mechanisms if they wish to do so.

The provisions altering the relationship between Federal and State government have a number of serious problems. For example, title III creates situations in which Federal employees could find themselves in a legal mess if caught between conflicting State and Federal direction of a cleanup site. This is an issue that was raised when this bill was considered by the committee. It was not resolved in committee, and it was not resolved before coming here to the House floor.

This is not the first bill this House has considered that demonstrated a disregard for Federal workers. This House has repeatedly turned to Federal workers to shoulder an unfair amount of the burden of deficit reduction.

Our erratic appropriation process has made their jobs more difficult, even as we have reduced their benefits and frozen their salaries.

We shut down the government, creating tremendous uncertainty for their families and barring people from their workplace. Now we are poised to pass a bill that might result in Federal workers being put in jail for doing their job.

Mr. Chair, I have touched on a few of the problems with this legislation. This is a poorly crafted bill that offers nothing for the public. It will not speed cleanups. It will not save money. It will not improve public health. This is bad policy and poorly crafted legislation. With that, I urge my colleagues to reject it.

Mr. Chair, I reserve the balance of my time.

Mr. Chair, I now yield 5 minutes to the distinguished gentleman from California (Mr. Waxman), the ranking member of the Energy and Commerce Committee, the former chair of the Energy and Commerce Committee, and a staunch defender in public policy and outspoken word for the environment.

Mr. Chair, I yield an additional 1 minute to the gentleman from California (Mr. Waxman).

Mr. Chairman, I yield 3 minutes to the chairman emeritus of the Energy and Commerce Committee and also the longest-serving Member of the House, my good friend from the State of Michigan (Mr. Dingell), who was at the table in 1980 to oversee the Superfund and knows more about the Superfund than perhaps anyone in the House.

Mr. Chairman, before I yield, I would like to make a few comments.

I keep hearing from the bill's supporters that the States need and want this legislation. I am a little confused by those statements. My staff called the Association of State and Territorial Solid Waste Management Officials, and they do not support the legislation. We also called the Environmental Council of the States, which represents the State environmental commissioners, and they have not endorsed the instant legislation before the House. So I am somewhat confused by the statements being made here.

I yield 3 minutes to the gentleman from New Jersey (Mr. Pallone), who has fought for many environmental causes through the committee on behalf of his home State of New Jersey and, for that matter, for this Nation.

Mr. Chairman, while the Environmental Council of the States may have supported some concepts of the bill, they have not moved to endorse the bill. I will stand by my statement.

Next I yield 3 minutes to the gentleman from Oregon (Mr. Blumenauer), a staunch defender of the environment and a good friend.

I yield 1 minute to the gentleman from Oregon (Mr. Blumenauer).

I yield 3 minutes to the gentleman from Minnesota (Mr. Ellison) who has organized the Environmental Justice Advocates of his home State of Minnesota, and is also the chair of the Progressive Caucus in the House.

Mr. Chair, I have no further speakers, and I am prepared to close.

Mr. Chair, H.R. 2279 is a deeply flawed bill that will increase costs, increase litigation, slow down the pace of cleanups, and, indeed, put the public at risk. It will do nothing to make cleanups at contaminated sites more efficient or more effective.

The proponent's intended goals for this legislation are not reflected in the bill's language. We can, and we should, do much better for people living in communities that are dealing with toxic legacies from past failures to deal with hazardous substances properly.

If we want to prevent new Superfund sites from being created and to clean up contaminated sites in their communities and convert them from liabilities to productive assets, we must reject H.R. 2279. I oppose this legislation and urge my colleagues to do the same.

With that, Mr. Chair, I yield back the balance of my time.

Mr. Chair, I have an amendment at the desk.

Mr. Chair, my amendment adds a savings clause to H.R. 2279 to avoid unintended consequences and detrimental impacts on current and future site cleanup efforts.

We certainly know that the actual provisions of the bill trump the intended goals of the legislation. If, as the supporters of this bill claim, it will not increase litigation, it will not increase costs or delay ongoing or future site cleanups, my amendment would have no effect. However, if the administration's analysis is correct--and I believe it is--my amendment will keep current site cleanups on track and ensure that taxpayer dollars are spent efficiently--spent on cleaning up contaminated sites and not spent in courtrooms.

If the committee had taken additional time to do the necessary oversight that would enable us to identify the best options for improving the Superfund program, my amendment would not be necessary, but the many problems with this bill that Democratic members of the committee have raised and that are echoed in the administration's analysis make my amendment truly necessary.

As the administration's statement of policy points out, H.R. 2279 severely reduces the Federal Government's role in the cleanup of Federal sites. The Federal Government's ability to set a ``worst first'' prioritization agenda for site cleanups is eliminated. The Federal Government pays the vast majority of the costs for site cleanups on Federal lands and sites on the National Priorities List. The Federal Government certainly should consult with the State on sites within its borders, but especially in cases where Federal land, Federal tax dollars, Federal employees, and Federal operations are concerned, the Federal Government should have the last word.

My amendment provides a prudent insurance policy to ensure that we do not use limited Superfund resources to litigate rather than to mitigate. My amendment ensures that we move forward. It ensures that we clean up these sites and convert them from revenue liabilities to revenue enhancements. It ensures that we reduce public health risks from contamination. With that, I urge my colleagues to support my amendment.

I reserve the balance of my time.

Mr. Chairman, our colleague and my friend from Ohio indicates that this bill will not increase litigation or increase costs or delay ongoing or future site cleanups, and so my amendment would not affect the measure before the House. So it really is a statement in support of the amendment. There is no just reason offered to not support the amendment.

With that, again, I would encourage my colleagues to support the amendment, and I yield back the balance of my time.

Mr. Chairman, I demand a recorded vote.