“(a) In general.—Not later than 180 days after the date of enactment of the Advanced Long-term care Early Response Technology Act of 2026, the Secretary, acting through the Director of the Centers for Disease Control and Prevention (referred to in this section as the ‘Secretary’), shall carry out a 5-year program to expand and enhance the National Healthcare Safety Network (referred to in this section as the ‘NHSN’) to establish real-time infectious disease and public health surveillance capabilities across nursing homes in the United States.

“(b) Contracting authority.—

“(1) IN GENERAL.—The Secretary may enter into one or more contracts with an eligible entity to develop, implement, and operate the technological and analytic infrastructure necessary to provide real-time surveillance and rapid notification capabilities under the NHSN.

“(2) ELIGIBILITY.—To be eligible to enter into a contract with the Secretary under paragraph (1), an entity—

“(A) shall be located in, or shall be a subsidiary of an entity that is located in, the United States;

“(B) shall have, and shall maintain for the period of the contract, HITRUST r2 certification (or a successor certification);

“(C) shall not be an electronic medical records company; and

“(D) shall demonstrate experience in establishing and operating a public health surveillance network that monitors infectious diseases or other public health threats at the State or local level.

“(c) Required capabilities.—Any contract entered into under subsection (b) shall—

“(1) ensure that the infrastructure developed pursuant to the contract is capable of—

“(A) providing real-time monitoring of emerging infectious diseases and other public health threats among nursing homes nationwide;

“(B) integrating with, and enhancing, the reporting systems of the NHSN;

“(C) establishing a central hub of epidemiologists and other public health professionals to support rapid identification of outbreaks;

“(D) providing for immediate notification to appropriate Federal, State, and local health authorities; and

“(E) supporting the implementation of a staffed care management program that skilled nursing facilities may opt into;

“(2) ensure appropriate privacy protections for individual patient data; and

“(3) prohibit the use of data collected or generated under the contract for regulatory compliance or enforcement purposes unless expressly authorized by law.

“(d) HIPAA and data protections.—The entity awarded a contract under subsection (b)—

“(1) shall be treated as a covered entity (as defined in section 160.103 of title 45, Code of Federal Regulations (or successor regulations)) for purposes of the privacy regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996; and

“(2) shall comply with all applicable Federal privacy and security requirements.

“(e) Study and report.—At the end of the period of the program described in subsection (a), the Secretary shall conduct, and submit to Congress a report that describes the results of, a study on—

“(1) the effectiveness of the enhanced NHSN system in monitoring infectious diseases and public health threats in nursing homes;

“(2) the impact of the enhanced NHSN system on hospitalization rates and patient outcomes; and

“(3) recommendations regarding continuation or expansion of the program under this section.

“(f) Authorization of appropriations.—To carry out this section, there is authorized to be appropriated such sums as may be necessary for each of fiscal years 2027 through 2031.”.

“(a) In general.—Not later than 180 days after the date of enactment of the Advanced Long-term care Early Response Technology Act of 2026, the Secretary, acting through the Director of the Centers for Disease Control and Prevention (referred to in this section as the ‘Secretary’), shall carry out a 5-year program to expand and enhance the National Healthcare Safety Network (referred to in this section as the ‘NHSN’) to establish real-time infectious disease and public health surveillance capabilities across nursing homes in the United States.

“(b) Contracting authority.—

“(1) IN GENERAL.—The Secretary may enter into one or more contracts with an eligible entity to develop, implement, and operate the technological and analytic infrastructure necessary to provide real-time surveillance and rapid notification capabilities under the NHSN.

“(2) ELIGIBILITY.—To be eligible to enter into a contract with the Secretary under paragraph (1), an entity—

“(A) shall be located in, or shall be a subsidiary of an entity that is located in, the United States;

“(B) shall have, and shall maintain for the period of the contract, HITRUST r2 certification (or a successor certification);

“(C) shall not be an electronic medical records company; and

“(D) shall demonstrate experience in establishing and operating a public health surveillance network that monitors infectious diseases or other public health threats at the State or local level.

“(c) Required capabilities.—Any contract entered into under subsection (b) shall—

“(1) ensure that the infrastructure developed pursuant to the contract is capable of—

“(A) providing real-time monitoring of emerging infectious diseases and other public health threats among nursing homes nationwide;

“(B) integrating with, and enhancing, the reporting systems of the NHSN;

“(C) establishing a central hub of epidemiologists and other public health professionals to support rapid identification of outbreaks;

“(D) providing for immediate notification to appropriate Federal, State, and local health authorities; and

“(E) supporting the implementation of a staffed care management program that skilled nursing facilities may opt into;

“(2) ensure appropriate privacy protections for individual patient data; and

“(3) prohibit the use of data collected or generated under the contract for regulatory compliance or enforcement purposes unless expressly authorized by law.

“(d) HIPAA and data protections.—The entity awarded a contract under subsection (b)—

“(1) shall be treated as a covered entity (as defined in section 160.103 of title 45, Code of Federal Regulations (or successor regulations)) for purposes of the privacy regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996; and

“(2) shall comply with all applicable Federal privacy and security requirements.

“(e) Study and report.—At the end of the period of the program described in subsection (a), the Secretary shall conduct, and submit to Congress a report that describes the results of, a study on—

“(1) the effectiveness of the enhanced NHSN system in monitoring infectious diseases and public health threats in nursing homes;

“(2) the impact of the enhanced NHSN system on hospitalization rates and patient outcomes; and

“(3) recommendations regarding continuation or expansion of the program under this section.

“(f) Authorization of appropriations.—To carry out this section, there is authorized to be appropriated such sums as may be necessary for each of fiscal years 2027 through 2031.”.