,,ii #aafth ,,congress #ast ,session ,s4 #ahdb ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,june #ac1 #bjai ,ms4 ,klobuchar 7for herself and ,ms4 ,murkowski7 introduced the following bill2 which was read twice and referred to the ,committee on ,health1 ,education1 ,labor1 and ,pensions ,a ,,bill ,to protect the personal health data of all ,americans4 #a4 ,short title ,this ,act may be cited as the ,protecting ,personal ,health ,data ,act4 #b4 ,findings ,congress finds as follows3 7#a7 ,on ,july #ai1 #bjaf1 the ,department of ,health and ,human ,services1 acting through the ,office of the ,national ,coordinator for ,health ,information ,technology and in coordination with the ,office for ,civil ,rights of the ,department of ,health and ,human ,services and the ,federal ,trade ,commission1 issued a report to ,congress entitled ,examining ,oversight of the ,privacy ,security of ,health ,data ,collected by ,entities ,not ,regulated by ,,hipaa 7referred to in this section as the report7 about the need to enact modern protections for consumers' personal health data4 7#b7 ,the report states that the wearable fitness trackers1 social media sites where individuals share health information through specific social networks1 and other technologies that are common today did not exist when ,congress enacted the ,health ,insurance ,portability and ,accountability ,act of #aiif4 7#c7 ,the report states that entities not covered by the privacy protections of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7,public ,law #ajd-aia71 such as wearable fitness trackers and health-focused social media sites1 engage in a variety of practices such as online advertising and marketing1 commercial uses or sale of individual information1 and behavioral tracking practices1 all of which indicate information use that is likely broader than what individuals would anticipate4 7#d7 ,the report identifies key gaps that exist between ,,hipaa regulated entities and those not regulated by ,,hipaa and recommends addressing those gaps in a way that protects consumers while leveling the playing field for innovators inside and outside of ,,hipaa4 #c4 ,definitions ,in this ,act3 7#a7 ,consumer devices1 services1 applications1 and software 7,a7 ,in general ,except as provided in subparagraph 7,c71 the term consumer devices1 services1 applications1 and software means devices1 services1 applications1 and software-- 7i7 that are primarily designed for or marketed to consumers2 and 7ii7 a substantial purpose or use of which is to collect or use personal health data4 7,b7 ,inclusion ,the term consumer devices1 services1 applications1 and software shall include1 but is not limited to-- 7i7 direct-to-consumer genetic testing services2 7ii7 cloud-based or mobile technologies that are designed to collect individuals' personal health data directly or indirectly with individuals' consent1 which could enable sharing of such information1 such as wearable fitness trackers2 and 7iii7 internet-based social media sites which are primarily designed for1 or marketed to1 consumers to collect or use personal health data1 including sites that share health conditions and experiences4 7,c7 ,exception ,the term consumer devices1 services1 applications1 and software shall not include-- 7i7 products on which personal health data is derived solely from other information that is not personal health data1 such as ,global ,positioning ,system data2 or 7ii7 products primarily designed for1 or marketed to1 covered entities and business associates 7as defined for purposes of regulations promulgated under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note774 7#b7 ,direct-to-consumer genetic testing services ,the term direct-to-consumer genetic testing service means a service1 which may include a test that analyzes various aspects of an individual's genetic material1 that enables a consumer to have access to their genetic information1 or to information derived therefrom1 without the need to have a health care provider or health insurance issuer participate in the process of gaining access4 7#c7 ,national coordinator ,the term ,national ,coordinator means the ,national ,coordinator for ,health ,information ,technology at the ,department of ,health and ,human ,services4 7#d7 ,operator ,the term operator means any person who operates any type of consumer devices1 services1 applications1 and software or who provides consumer devices1 services1 applications1 and software for the use of consumers and collects or maintains personal health data from or about the users of such consumer devices1 services1 applications1 and software4 7#e7 ,personal health data ,the term personal health data means any information1 including genetic information1 whether oral or recorded in any form or medium1 that relates to the past1 present1 or future physical or mental health or condition of an individual and that identifies the individual or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual4 7#f7 ,secretary ,the term ,secretary means the ,secretary of ,health and ,human ,services4 #d4 ,promulgation of regulations for operators of consumer devices1 services1 applications1 and software 7a7 ,in general ,not later than #f months after the date on which the report is submitted under section #e7;d71 the ,secretary1 in consultation with the ,chairman of the ,federal ,trade ,commission1 the ,national ,coordinator1 relevant stakeholders1 and heads of such other ,federal agencies as the ,secretary considers appropriate1 shall promulgate regulations to help strengthen privacy and security protections for consumers' personal health data that is collected1 processed1 analyzed1 or used by consumer devices1 services1 applications1 and software4 7b7 ,requirements 7#a7 ,in general ,the ,secretary shall ensure that the regulations pursuant to subsection 7a7-- 7,a7 account for differences in the nature and sensitivity of the data collected or stored on the consumer device1 service1 application1 or software2 and 7,b7 include such definitions for relevant terms that are necessary to accomplish the goals of the regulations set forth in subsection 7a74 7#b7 ,requirements of secretary ,in the promulgation of regulations under subsection 7a71 the ,secretary1 to the extent practicable1 shall-- 7,a7 consider the findings in the report issued by the ,department of ,health and ,human ,services to ,congress entitled ,examining ,oversight of the ,privacy ,security of ,health ,data ,collected by ,entities ,not ,regulated by ,,hipaa1 including findings regarding individuals' access rights1 re-use of data by third parties1 security standards applicable to data holders and users1 confusion or ambiguity regarding terminology related to privacy and security protections1 and the adequacy of collection1 use1 and disclosure limitations2 7,b7 consider other regulations and guidance issued by the ,federal ,trade ,commission1 and other regulations promulgated under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note71 subtitle ,d of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agiba et seq471 ,genetic ,information ,nondiscrimination ,act 7,public ,law #aaj-bcc1 #abb ,stat4 #hha71 the ,common ,rule as contained in part #df of title #de1 ,code of ,federal ,regulations1 and other related ,acts2 7,c7 consistent with paragraph 7#c71 consider appropriate uniform standards for consent related to the handling of genetic data1 biometric data1 and personal health data2 7,d7 consider exceptions to consent requirements under subparagraph 7,c7 for purposes that may include law enforcement1 academic research or research for the sole purpose of assessing health care utilization and outcomes1 emergency medical treatment1 or determining paternity2 7,e7 consider appropriate minimum standards of security that may differ according to the nature and sensitivity of the data collected or stored on1 or processed or transferred by1 the consumer device1 service1 application1 or software2 7,f7 consider appropriate standards for the de-identification of personal health data2 7,g7 consider appropriate limitations on the collection1 use1 or disclosure of personal health data to that which is directly relevant and necessary to accomplish a specified purpose2 7,h7 consult with the ,national ,coordinator1 the ,commissioner of ,food and ,drugs1 and the ,chairman of the ,federal ,trade ,commission2 and 7,i7 provide for initial and ongoing outreach regarding regulations affecting industries1 businesses1 and individuals to ensure awareness of consumer privacy and security protections in the field of digital health technology4 7#c7 ,uniform standards ,in the review of each of the areas described in paragraph 7#b77;,c71 the ,secretary shall consider-- 7,a7 the development of standards for obtaining user consent based on how information will be shared to ensure that prior to the collection1 analysis1 use1 or disclosure of consumers' personal health data1 an operator of a consumer device1 service1 application1 or software specifies the uses of the personal health data and who will have access to the information2 7,b7 the manner in which consent is obtained in a way that uses clear1 concise1 and well-organized language that is easily accessible1 of reasonable length1 at an appropriate level of readability1 and clearly distinguishable from other matters2 7,c7 a process to limit the transfer of personal health data to third parties and provide consumers with greater control over how their personal health data is used for marketing purposes2 7,d7 secondary uses outside of the primary purpose of the service as initially indicated when consent was first obtained2 7,e7 a process to permit a withdrawal of consent to ensure that a user is able to remove consent for the terms of service for use of the consumer device1 service1 application1 or software1 including the collection and use of personal health data as easily as the user is able to give such consent2 7,f7 providing a right to access a copy of the personal health data that the operator has collected1 analyzed1 or used1 free of charge and in an electronic and easily accessible format1 including a list of each entity that received the personal health data from the operator1 whether through sale or other means2 and 7,g7 providing a right to delete and amend personal health data1 to the extent practicable1 that the operator has collected1 analyzed1 or used4 7c7 ,updates ,the ,secretary shall review and1 if necessary1 update the regulations promulgated under subsection 7a7 in accordance with the requirements under subsection 7b74 7d7 ,public availability ,the ,department of ,health and ,human ,services shall make prominently available to the public on the ,department's internet website1 clear and concise information about available resources related to the regulations promulgated under subsection 7a7 and all updates to such resources4 7e7 ,consistency of resources published by ,federal agencies ,if a ,federal agency publishes resources to help protect consumers' personal health data1 the head of such ,federal agency1 to the degree practicable1 shall make such resources consistent with the regulations promulgated under subsection 7a74 7f7 ,other ,federal privacy and security requirements ,nothing in this section shall be construed to supersede1 alter1 or otherwise affect any privacy and security requirements enforced by ,federal agencies4 #e4 ,national task force on health data protection 7a7 ,establishment ,the ,secretary1 in consultation with the ,chairman of the ,federal ,trade ,commission1 the ,national ,coordinator1 and relevant stakeholders1 shall establish a task force1 to be known as the ,national ,task ,force on ,health ,data ,protection 7referred to in this section as the ,task ,force74 7b7 ,duties ,the ,task ,force shall-- 7#a7 study the long-term effectiveness of de-identification methodologies for genetic data and biometric data2 7#b7 evaluate and provide input on the development of security standards1 including encryption standards and transfer protocols1 for consumer devices1 services1 applications1 and software2 7#c7 evaluate and provide input with respect to addressing cybersecurity risks and security concerns related to consumer devices1 services1 applications1 and software2 7#d7 evaluate and provide input with respect to the privacy concerns and protection standards related to consumer and employee health data2 7#e7 review and advise on the need1 if any1 to update the report issued by the ,department of ,health and ,human ,services to ,congress entitled ,examining ,oversight of the ,privacy ,security of ,health ,data ,collected by ,entities ,not ,regulated by ,,hipaa2 and 7#f7 provide advice and consultation in the establishment and dissemination of resources to educate and advise consumers about the basics of genetics and direct-to-consumer genetic testing1 and the risks1 benefits1 and limitations of such testing4 7c7 ,members ,the ,secretary1 in consultation with the ,chairman of the ,federal ,trade ,commission1 the ,national ,coordinator1 and relevant stakeholders1 shall appoint not more than #ae members to the ,task ,force4 ,in appointing such members1 the ,secretary shall ensure that the total membership of the ,task ,force is an odd number and represents a diverse set of stakeholder perspectives4 7d7 ,reporting ,not later than #a year after the date of enactment of this ,act1 the ,task ,force shall prepare and submit to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate1 the ,committee on ,health1 ,education1 ,labor1 and ,pensions of the ,senate1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 the ,committee on ,energy and ,commerce of the ,house of ,representatives1 the ,committee on ,homeland ,security of the ,house of ,representatives1 the ,secretary1 the ,chairman of the ,federal ,trade ,commission1 and the ,commissioner of ,food and ,drugs1 a report on the findings of the ,task ,force4 7e7 ,authorization of appropriations ,there are authorized to be appropriated such sums as may be necessary to carry out this section4 7f7 ,federal ,advisory ,committee ,act ,the ,federal ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app47 shall apply to the ,task ,force4 7g7 ,sunset 7#a7 ,in general ,the ,task ,force shall terminate on the date that is #e years after the date of the first meeting of the ,task ,force4 7#b7 ,recommendation ,not later than the date that is one year prior to the termination of the ,task ,force under paragraph 7#a71 the ,secretary shall submit to ,congress a recommendation on whether the ,task ,force should be extended4