,i #aafth ,,congress #b;d ,session ,h4 ,r4 #gdgb ,,in ,,the ,,house ,,of ,,representatives ,july #a1 #bjbj ,ms4 ,speier 7for herself1 ,ms4 ,de,gette1 ,mrs4 ,dingell1 ,mr4 ,carson of ,indiana1 ,ms4 ,barragn1 ,mr4 ,lynch1 ,mr4 ,raskin1 ,mr4 ,san ,nicolas1 ,mr4 ,takano1 and ,mr4 ,hastings7 introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce ,a ,,bill ,to authorize the ,director of the ,centers for ,disease ,control and ,prevention to award grants to eligible ,state1 ,tribal1 and territorial public health agencies to develop and administer a program for digital contact tracing for ,,covid-#ai1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,secure ,data and ,privacy for ,contact ,tracing ,act of #bjbj4 #b4 ,grant program for digital contact tracing for ,,covid-#ai 7a7 ,in general ,the ,director of the ,centers for ,disease ,control and ,prevention shall award grants to eligible ,state1 ,tribal1 and territorial public health agencies to-- 7#a7 establish a contact-tracing program that implements traditional contact tracing protocols with the assistance of digital contact tracing technology to track and prevent the spread of ,,covid-#ai2 or 7#b7 incorporate digital contact tracing technology into a contact-tracing program that implements traditional contact tracing protocols to track and prevent the spread of ,,covid-#ai4 7b7 ,funding disqualification ,if a ,state1 ,tribal1 or territorial public health agency develops or procures any digital contact tracing technology with respect to ,,covid-#ai that does not meet each of the requirements listed in subsection 7c71 such ,state1 ,tribal1 or territorial public health agency shall be ineligible to receive or continue to receive-- 7#a7 any funds through a grant under this section2 and 7#b7 any other ,federal funds1 including under the ,,cares ,act 7,public ,law #aaf-acf71 for any digital contact-tracing technology with respect to ,,covid-#ai4 7c7 ,digital contact-,tracing requirements ,a ,state1 ,tribal1 or territorial public health agency may use a grant under this section for digital contact tracing technology1 as described in subsection 7a71 only if the technology meets each of the following requirements3 7#a7 ,the technology shall be voluntary for the user and provide to the user complete and clear information on the intended use and processing of data collected by the technology4 ,to be voluntary for the user1 the technology shall meet requirements including each of the following3 7,a7 ,use of the technology and of contact-tracing data collected using the technology shall be predicated on the user's affirmative consent4 7,b7 ,use of the technology shall not be a condition for the reception of government benefits4 7,c7 ,use of the technology shall not be made a condition of employment or employment status4 7#b7 ,the technology shall limit the collection of data by the technology to only the data that is necessary to meet contact-tracing objectives1 including-- 7,a7 the status of any person as an infected or potentially infected person2 and 7,b7 the proximity of a person to someone who is symptomatic or has tested positive4 7#c7 ,the technology-- 7,a7 shall delete or de-identify any contact-tracing data that is individually identifiable information not later than the date that is #cj days after the end of the ,,covid-#ai emergency declaration2 and 7,b7 shall include notifications to prompt users to disable or completely remove any digital contact-tracing technology where practical4 7#d7 ,the technology shall have robust contact detection specifications1 including for distance and time1 that allow for detection consistent with guidance of the ,centers for ,disease ,control and ,prevention on ,,covid-#ai4 7#e7 ,the technology shall ensure that the storing of proximity and any contact-tracing data is encrypted to the maximum extent possible4 7d7 ,plan for interoperability ,as a condition on receipt of a grant under this section1 a ,state1 ,tribal1 or territorial public health agency shall-- 7#a7 develop and make publicly available a plan for how the digital contact-tracing technology of the agency with respect to ,,covid-#ai augments-- 7,a7 traditional contact tracing efforts1 if applicable2 and 7,b7 statewide efforts to prevent1 prepare for1 and respond to ,,covid-#ai2 and 7#b7 include in such plan a description of the agency's efforts to ensure that the digital contact-tracing technologies of the agency with respect to ,,covid-#ai are interoperable with the digital contact-tracing technology and public health agency databases of other jurisdictions with respect to ,,covid-#ai2 and 7#c7 ensure that data collected by the digital contact-tracing technology of the agency-- 7,a7 is accessed and processed only by public health authorities 7or their designees72 and 7,b7 is not shared with any person1 or accessed or used by any person1 for any purpose other than diagnosis1 containment1 treatment1 or reduction of1 or research into1 ,,covid-#ai4 7e7 ,independent security assessments 7#a7 ,in general ,as a condition on receipt of a grant under this section1 a ,state1 ,tribal1 or territorial public health agency shall-- 7,a7 establish procedures for completing or obtaining independent security assessments of digital contact-tracing infrastructure to ensure that physical and network security is resilient and secure2 and 7,b7 develop a process to address the mitigation or remediation of the security vulnerabilities discovered during such independent security assessments4 7#b7 ,source code ,a ,state1 ,tribal1 or territorial public health agency should consider making public the source code of the digital contact-tracing technology used by the agency4 7f7 ,application ,to seek a grant under this section1 an eligible ,state1 ,tribal1 or territorial public health agency shall submit an application in such form1 in such manner1 and containing such information and assurances as the ,director may require4 7g7 ,securing digital contact-,tracing data 7#a7 ,in general ,the provisions of the ,,hipaa privacy and security law 7as defined in section #cjji7;a77#b7 of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #cjj;jj-#ai7;a77#b777 shall apply to a ,state1 ,tribal1 or territorial public health agency receiving a grant under subsection 7a7 with respect to individually identifiable health information 7as defined in section #aaga7;a77#f7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d7a77#f777 received by1 maintained on1 or transmitted through a contact-tracing program described in such subsection 7a7 in the same manner as such provisions apply with respect to such information and a covered entity 7as defined in section #acdjj7c7 of the ,,hitech ,act 7#db ,u4,s4,c4 #agiba7c7774 7#b7 ,business associates 7,a7 ,in general ,any entity with a contract in effect with an agency described in paragraph 7#a7 for the development1 maintenance1 or operation of a program described in such paragraph shall be deemed to be a business associate of such agency for purposes of subtitle ,d of the ,,hitech ,act 7#db ,u4,s4,c4 #agiba et seq474 7,b7 ,revision of sample agreement ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary shall revise the sample business associate agreement provisions published on ,january #be1 #bjac1 to take account of the provisions of this subsection4 7,c7 ,effective date ,the provisions of subparagraph 7,a7 shall apply beginning on the day after the ,secretary revises the provisions described in subparagraph 7,b74 7h7 ,limitation on use of data ,data generated in connection with the operation of digital contact tracing technology funded pursuant to this section may not be used for any punitive purpose1 including law enforcement1 immigration enforcement1 or criminal prosecution4 ,such data and any information derived from it1 whether in whole or in part1 may not be received as evidence in any trial1 hearing1 or other proceeding in or before any court1 grand jury1 department1 officer1 agency1 regulatory body1 legislative committee1 or other authority of the ,united ,states1 a ,state1 or a political subdivision thereof4 7i7 ,report to ,congress ,not later than #ij days after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall-- 7#a7 evaluate the outcome of the grants awarded under this section1 including an assessment of the impact of the implementation of digital contact-tracing programs funded through such grants on the spread of ,,covid-#ai2 and 7#b7 submit to the ,congress a report on the results of such evaluation4 7j7 ,definitions ,in this section3 7#a7 ,affirmative express consent ,the term affirmative express consent means an affirmative act by an individual that clearly and conspicuously communicates the individual's authorization for an act or practice1 in response to a specific request that-- 7,a7 is provided to the individual in a clear and conspicuous disclosure that is separate from other options or acceptance of general terms2 7,b7 includes a description of each act or practice for which the individual's consent is sought and-- 7i7 is written clearly and unmistakably stated2 and 7ii7 includes a prominent heading that would enable a reasonable individual to identify and understand the act or practice2 and 7,c7 cannot be inferred from inaction4 7#b7 ,contact-tracing data ,the term contact-tracing data means information linked or reasonably linkable to a user or device1 that-- 7,a7 concerns the ,,covid-#ai pandemic2 and 7,b7 is gathered1 processed1 or transferred by digital contact tracing technology4 7#c7 ,,covid-#ai emergency declaration ,the term ,,covid-#ai emergency declaration has the meaning given to such term in section #aace7;g77#a77;,b7 of the ,social ,security ,act 7#db ,u4,s4,c4 #acbj;b-#e74 7#d7 ,de-identify ,the term de-identify means to ensure that information cannot reasonably identify1 relate to1 describe1 be capable of being associated with1 or be linked1 directly or indirectly1 to a particular individual4 7#e7 ,designee ,the term designee-- 7,a7 subject to subparagraph 7,b71 means any person or entity1 other than a public health agency1 that collects1 processes1 or transfers contact-tracing data in the course of performing a service or function on behalf of1 for the benefit of1 under instruction of1 and under contractual agreement with a public health authority2 and 7,b7 excludes any ,federal1 ,state1 ,tribal1 territorial1 or local law 7including immigration law7 enforcement personnel or entity4 7#f7 ,digital contact-tracing technology 7,a7 ,in general ,the term digital contact-tracing technology means a website1 online application1 mobile application1 mobile operating system feature1 or smart device application that is designed1 in part or in full1 for the purpose of-- 7i7 determining that a contact incident has occurred relating to the ,,covid-#ai pandemic2 and 7ii7 taking consequent steps such as reporting the incident to a public health authority or user1 or providing guidance or instructions to the user of the mobile device or the user's household4 7,b7 ,limitations ,such term does not include any technology to assist individuals to evaluate whether they are experiencing ,,covid-#ai symptoms to the extent the technology is not used as described in subparagraph 7,a74 7#g7 ,director ,the term ,director means the ,director of the ,centers for ,disease ,control and ,prevention4 7#h7 ,mobile ,application ,the term mobile application means a software program that runs on the operating system of a mobile device4 7#i7 ,mobile device ,the term mobile device means a smartphone1 tablet computer1 or similar portable computing device that transmits data over a wireless connection4 7#aj7 ,source code ,the term source code is the programming instruction for a computer program in its original form and saved in a file4 7#aa7 ,traditional contact tracing ,the term traditional contact tracing means contact tracing by traditional means prior to contemporary digital contact tracing4 7#ab7 ,user ,the term user means a member of the public who utilizes the software or hardware product4 7k7 ,authorization of appropriations ,to carry out this section1 there are authorized to be appropriated #ge1jjj1jjj1 to remain available until expended4