,,ii #aafth ,,congress #b;d ,session ,s4 #cgdi ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,may #ad1 #bjbj,mr4 ,blumenthal 7for himself and ,mr4 ,warner7 introduced the following bill2 which was read twice and referred to the ,committee on ,health1 ,education1 ,labor1 and ,pensions ,a ,,bill ,to protect the privacy of health information during a national health emergency4 #a4 ,short title ,this ,act may be cited as the ,public ,health ,emergency ,privacy ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,affirmative express consent ,the term affirmative express consent means an affirmative act by an individual that-- 7,a7 clearly and conspicuously communicates the individual's authorization of an act or practice2 7,b7 is made in the absence of any mechanism in the user interface that has the purpose or substantial effect of obscuring1 subverting1 or impairing decision making or choice to obtain consent2 and 7,c7 cannot be inferred from inaction4 7#b7 ,collect ,the term collect1 with respect to emergency health data1 means obtaining in any manner by a covered organization4 7#c7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#d7 ,covered organization 7,a7 ,in general ,the term covered organization means any person 7including a government entity7-- 7i7 that collects1 uses1 or discloses emergency health data electronically or through communication by wire or radio2 or 7ii7 that develops or operates a website1 web application1 mobile application1 mobile operating system feature1 or smart device application for the purpose of tracking1 screening1 monitoring1 contact tracing1 or mitigation1 or otherwise responding to the ,,covid-#ai public health emergency4 7,b7 ,exclusions ,the term covered organization does not include-- 7i7 a health care provider2 7ii7 a person engaged in a de minimis collection or processing of emergency health data2 7iii7 a service provider2 7iv7 a person acting in their individual or household capacity2 or 7v7 a public health authority4 7#e7 ,demographic data ,the term demographic data means information relating to the actual or perceived race1 color1 ethnicity1 national origin1 religion1 sex1 gender1 gender identity1 sexual orientation1 age1 ,tribal affiliation1 disability1 domicile1 employment status1 familial status1 immigration status1 or veteran status of an individual or group of individuals4 7#f7 ,device ,the term device means any electronic equipment that is primarily designed for or marketed to consumers4 7#g7 ,disclosure ,the term disclosure1 with respect to emergency health data1 means the releasing1 transferring1 selling1 providing access to1 licensing1 or divulging in any manner by a covered organization to a third party4 7#h7 ,emergency health data ,the term emergency health data means data linked or reasonably linkable to an individual or device1 including data inferred or derived about the individual or device from other collected data provided such data is still linked or reasonably linkable to the individual or device1 that concerns the public ,,covid-#ai health emergency4 ,such data includes-- 7,a7 information that reveals the past1 present1 or future physical or behavioral health or condition of1 or provision of healthcare to1 an individual1 including-- 7i7 data derived from the testing or examination of a body part or bodily substance1 or a request for such testing2 7ii7 whether or not an individual has contracted or been tested for1 or an estimate of the likelihood that a particular individual may contract1 such disease or disorder2 and 7iii7 genetic data1 biological samples1 and biometrics2 and 7,b7 other data collected in conjunction with other emergency health data or for the purpose of tracking1 screening1 monitoring1 contact tracing1 or mitigation1 or otherwise responding to the ,,covid-#ai public health emergency1 including-- 7i7 geolocation data1 when such term means data capable of determining the past or present precise physical location of an individual at a specific point in time1 taking account of population densities1 including cell-site location information1 triangulation data derived from nearby wireless or radio frequency networks1 and global positioning system data2 7ii7 proximity data1 when such term means information that identifies or estimates the past or present physical proximity of one individual or device to another1 including information derived from ,bluetooth1 audio signatures1 nearby wireless networks1 and near-field communications2 7iii7 demographic data2 7iv7 contact information for identifiable individuals or a history of the individual's contacts over a period of time1 such as an address book or call log2 and 7v7 any other data collected from a personal device4 7#i7 ,government entity ,the term government entity includes a ,federal agency1 a ,state1 a local government1 and other organizations1 as such terms are defined in section #ccga of title #e1 ,united ,states ,code4 7#aj7 ,health care provider ,the term health care provider has the meaning given the term eligible health care provider in title ,,viii of division ,b of the ,,cares ,act 7,public ,law #aaf-acf74 7#aa7 ,,hipaa regulations ,the term ,,hipaa regulations means parts #afj and #afd of title #de1 ,code of ,federal ,regulations4 7#ab7 ,public health authority ,the term public health authority means an entity that is authorized by law to collect or receive information for the purpose of preventing or controlling disease1 injury1 or disability including1 but not limited to1 the reporting of disease1 injury1 vital events such as birth or death1 and the conduct of public health surveillance1 public health investigations1 and public health interventions1 and a person1 such as a designated agency or associate1 acting under a grant of authority from1 or under a contract with1 such public entity1 including the employees or agents of such entity or its contractors or persons or entities to whom it has granted authority4 7#ac7 ,,covid-#ai ,public health emergency ,the term ,,covid-#ai public health emergency means the outbreak and public health response pertaining to ,coronavirus ,disease #bjai 7,,covid-#ai71 associated with the emergency declared by the ,secretary on ,january #ca1 #bjbj1 under section #cai of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #bdg;d71 and any renewals thereof and any subsequent declarations by the ,secretary related to the coronavirus4 7#ad7 ,secretary ,the term ,secretary means the ,secretary of ,health and ,human ,services4 7#ae7 ,service provider 7,a7 ,in general ,the term service provider means a person that collects1 uses1 or discloses emergency health data for the sole purpose of1 and only to the extent that such entity is1 conducting business activities on behalf of1 for the benefit of1 under instruction of1 and under contractual agreement with a covered organization4 7,b7 ,limitation of application ,such person shall only be considered a service provider in the course of activities described in subparagraph 7,a74 7,c7 ,exclusions ,the term service provider excludes a person that develops or operates a website1 web application1 mobile application1 or smart device application for the purpose of tracking1 screening1 monitoring1 contact tracing1 or mitigation1 or otherwise responding to the ,,covid-#ai public health emergency4 7#af7 ,state ,the term ,state means each ,state of the ,united ,states1 the ,district of ,columbia1 each commonwealth1 territory1 or possession of the ,united ,states1 and each federally recognized ,indian ,tribe4 7#ag7 ,third party 7,a7 ,in general ,the term third party means1 with respect to a covered organization-- 7i7 another person to whom such covered organization disclosed emergency health data2 and 7ii7 a corporate affiliate or a related party of the covered organization that does not have a direct relationship with an individual with whom the emergency health data is linked or is reasonably linkable4 7,b7 ,exclusion ,the term third party excludes1 with respect to a covered organization-- 7i7 a service provider of such covered organization2 or 7ii7 a public health authority4 7#ah7 ,use ,the term use1 with respect to emergency health data1 means the processing1 employment1 application1 utilization1 examination1 or analysis of such data by a covered organization that maintains such data4 #c4 ,protecting the privacy and security of emergency health data 7a7 ,right to privacy ,a covered organization that collects emergency health data shall-- 7#a7 only collect1 use1 or disclose such data that is necessary1 proportionate1 and limited for a good faith public health purpose1 including a service or feature to support such a purpose2 7#b7 take reasonable measures1 where possible1 to ensure the accuracy of emergency health data and provide an effective mechanism for an individual to correct inaccurate information2 7#c7 adopt reasonable safeguards to prevent unlawful discrimination on the basis of emergency health data2 and 7#d7 only disclose such data to a government entity when the disclosure-- 7,a7 is to a public health authority2 and 7,b7 is made in solely for good faith public health purposes and in direct response to exigent circumstances4 7b7 ,right to security ,a covered organization or service provider that collects1 uses1 or discloses emergency health data shall establish and implement reasonable data security policies1 practices1 and procedures to protect the security and confidentiality of emergency health data4 7c7 ,prohibited uses ,a covered organization shall not collect1 use1 or disclose emergency health data for any purpose not authorized under this section1 including-- 7#a7 commercial advertising1 recommendation for e-commerce1 or the training of machine-learning algorithms related to1 or subsequently for use in1 commercial advertising and e-commerce2 7#b7 soliciting1 offering1 selling1 leasing1 licensing1 renting1 advertising1 marketing1 or otherwise commercially contracting for employment1 finance1 credit1 insurance1 housing1 or education opportunities in a manner that discriminates or otherwise makes opportunities unavailable on the basis of emergency health data2 and 7#c7 segregating1 discriminating in1 or otherwise making unavailable the goods1 services1 facilities1 privileges1 advantages1 or accommodations of any place of public accommodation 7as such term is defined in section #cja of the ,americans ,with ,disabilities ,act of #aiij 7#db ,u4,s4,c4 #abaha771 except as authorized by a ,state or ,federal ,government entity for a public health purpose notwithstanding subsection 7g74 7d7 ,consent 7#a7 ,in general ,it shall be unlawful for a covered organization to collect1 use1 or disclose emergency health data1 unless-- 7,a7 the individual to whom the data pertains has given affirmative express consent to such collection1 use1 or disclosure2 7,b7 such collection1 use1 or disclosure is necessary and for the sole purpose of-- 7i7 protecting against malicious1 deceptive1 fraudulent1 or illegal activity2 or 7ii7 detecting1 responding to1 or preventing information security incidents or threats2 or 7,c7 the covered organization is compelled to do so by a legal obligation4 7#b7 ,revocation 7,a7 ,in general ,a covered organization shall provide an effective mechanism for an individual to revoke consent after it is given4 7,b7 ,effect ,after an individual revokes consent1 the covered organization shall cease collecting1 using1 or disclosing the individual's emergency health data as soon as practicable1 but in no case later than #ae days after the receipt of the individual's revocation of consent4 7,c7 ,destruction ,not later than #cj days after the receipt of an individual's revocation of consent1 a covered organization shall destroy or render not linkable that individuals emergency health data under the same procedures in subsection 7f74 7e7 ,notice ,a covered organization that collects1 uses1 or discloses emergency health data shall provide to an individual a privacy policy that-- 7#a7 is disclosed in a clear and conspicuous manner1 in the language in which the individual typically interacts with the covered organization1 prior to or at the point of the collection of emergency health data2 7#b7 describes how and for what purposes the covered organization collects1 uses1 and discloses emergency health data1 including the categories of recipients to whom it discloses data and the purpose of disclosure for each category2 7#c7 describes the covered organization's data retention and data security policies and practices for emergency health data2 and 7#d7 describes how an individual may exercise the rights under this ,act and how to contact the ,commission to file a complaint4 7f7 ,public reporting 7#a7 ,in general ,a covered organization that collects1 uses1 or discloses emergency health data of at least #ajj1jjj individuals shall1 at least once every #ij days1 issue a public report-- 7,a7 stating in aggregate terms the number of individuals whose emergency health data the covered organization collected1 used1 or disclosed to the extent practicable2 and 7,b7 describing the categories of emergency health data collected1 used1 or disclosed1 the purposes for which each such category of emergency health data was collected1 used1 or disclosed1 and the categories of third parties to whom it was disclosed4 7#b7 ,rules of construction ,nothing in this subsection shall be construed to require a covered organization to-- 7,a7 take an action that would convert data that is not emergency health data into emergency health data2 7,b7 collect or maintain emergency health data that the covered organization would otherwise not maintain2 or 7,c7 maintain emergency health data longer than the covered organization would otherwise maintain such data4 7g7 ,required data destruction 7#a7 ,in general ,a covered organization may not use or maintain emergency health data of an individual after the later of-- 7,a7 the date that is #fj days after the termination of the public health emergency declared by the ,secretary on ,january #ca1 #bjbj1 pertaining to ,coronavirus ,disease #bjai 7,,covid-#ai7 under section #cai of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #bdg;d7 and any renewals thereof2 7,b7 the date that is #fj days after the termination of a public health emergency declared by a governor or chief executive of a ,state pertaining to ,coronavirus ,disease #bjai 7,,covid-#ai7 in which the individual resides2 or 7,c7 #fj days after collection4 7#b7 ,requirement ,for the requirements under paragraph 7#a71 data shall be destroyed or rendered not linkable in such a manner that it is impossible or demonstrably impracticable to identify any individual from the data4 7#c7 ,relation to certain requirements ,the provisions of this subsection shall not supersede any requirements or authorizations under-- 7,a7 the ,privacy ,act of #aigd 7,public ,law #ic-gi72 7,b7 the ,,hippa regulations2 or 7,c7 ,federal or ,state medical records retention and health privacy laws or regulations1 or other applicable ,federal or ,state laws4 7h7 ,emergency data collected1 used1 or disclosed before enactment 7#a7 ,initiating a rulemaking ,not later than #g days after the date of enactment of this ,act1 the ,commission shall initiate a public rulemaking to promulgate regulations to ensure a covered organization that has collected1 used1 or disclosed emergency health data before the date of enactment of this ,act is in compliance with this ,act1 to the degree practicable4 7#b7 ,completing a rulemaking ,the ,commission shall complete the rulemaking within #de days after the date of enactment of this ,act4 7i7 ,non-,application to manual contact tracing and case investigation ,nothing in this ,act shall be construed to limit or prohibit a public health authority from administering programs or activities to identify individuals who have contracted1 or may have been exposed to1 ,,covid-#ai through interviews1 outreach1 case investigation1 and other recognized investigatory measures by a public health authority or their designated agent by a public health authority or their designated agent intended to monitor and mitigate the transmission of a disease or disorder4 7j7 ,research and development ,this section shall not be construed to prohibit-- 7#a7 public health or scientific research associated with the ,,covid-#ai public health emergency by-- 7,a7 a public health authority2 7,b7 a nonprofit organization1 as described in section #eja7;c77#c7 of the ,internal ,revenue ,code of #aihf2 or 7,c7 an institution of higher education1 as such term is defined in section #aja of the ,higher ,education ,act of #aife 7#bj ,u4,s4,c4 #ajja72 or 7#b7 research1 development1 manufacture1 or distribution of a drug1 biological product1 or vaccine that relates to a disease or disorder that is associated or potentially associated with a public health emergency4 7k7 ,legal requirements ,notwithstanding subsection 7a77#e71 nothing in this ,act shall be construed to prohibit a good faith response to1 or compliance with1 otherwise valid subpoenas1 court orders1 or other legal processes1 or to prohibit storage or providing information as otherwise required by law4 7l7 ,application to ,,hipaa covered entities 7#a7 ,in general ,this ,act does not apply to a covered entity or a person acting as a business associate under the ,,hipaa regulations 7to the extent that such entities or associates are acting in such capacity7 or any health care provider4 7#b7 ,guidance for consistency ,not later than #cj days after the date of enactment of this ,act1 the ,secretary shall promulgate guidance on the applicability of requirements1 similar to those in this section to covered entities and persons acting as business associates under the ,,hipaa regulations4 ,in promulgating such guidance1 the ,secretary shall reduce duplication of requirements and may exclude a requirement of this section if such requirement is already a requirement of the ,,hipaa regulations4 #d4 ,protecting the right to vote 7a7 ,in general ,a government entity may not1 and a covered organization may not knowingly facilitate1 on the basis of an individual's emergency health data1 medical condition1 or participation or non-participation in a program to collect emergency health data-- 7#a7 deny1 restrict1 or interfere with the right to vote in a ,federal1 ,state1 or local election2 7#b7 attempt to deny1 restrict1 or interfere with the right to vote in a ,federal1 ,state1 or local election2 or 7#c7 retaliate against an individual for voting in a ,federal1 ,state1 or local election4 7b7 ,civil action ,in the case of any violation of subsection 7a71 an individual may bring a civil action to obtain appropriate relief against a government entity in a ,federal district court4 #e4 ,reports on civil rights impacts 7a7 ,report required ,the ,secretary1 in consultation with the ,united ,states ,commission on ,civil ,rights and the ,commission1 shall prepare and submit to ,congress reports that examines the civil rights impact of the collection1 use1 and disclosure of health information in response to the ,,covid-#ai public health emergency4 7b7 ,scope of report ,each report required under subsection 7a7 shall1 at a minimum-- 7#a7 evaluate the impact of such practices on civil rights and protections for individuals based on race1 color1 ethnicity1 national origin1 religion1 sex1 gender1 gender identity1 sexual orientation1 age1 ,tribal affiliation1 disability1 domicile1 employment status1 familial status1 immigration status1 or veteran status2 7#b7 analyze the impact1 risks1 costs1 legal considerations1 disparate impacts1 and other implications to civil rights of policies to incentivize or require the adoption of digital tools or apps used for contact tracing1 exposure notification1 or health monitoring2 and 7#c7 include recommendations on preventing and addressing undue or disparate impact1 segregation1 discrimination1 or infringements of civil rights in the collection and use of health information1 including during a national health emergency4 7c7 ,timing 7#a7 ,initial report ,the ,secretary shall submit an initial report under subsection 7a7 not sooner than #i months1 and not later than #ab months after the date of enactment of this ,act4 7#b7 ,subsequent reports ,the ,secretary shall submit reports annually after the initial report required under paragraph 7#a7 until #a year after the termination of any public health emergency pertaining to ,coronavirus ,disease #bjai 7,,covid-#ai7 under section #cai of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #bdg;d74 #f4 ,enforcement 7a7 ,federal ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of this ,act or a regulation promulgated under this ,act shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7#b7 ,powers of ,commission ,the ,commission shall enforce this ,act and the regulations promulgated under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 ,any person who violates this ,act or a regulation promulgated under this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act4 ,provided1 however1 that1 notwithstanding the requirements of section #af7;a7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #ef7;a771 the ,commission shall have the exclusive authority to commence or defend1 and supervise the litigation of1 any action for a violation of this ,act or a regulation promulgated under this ,act and any appeal of such action in its own name by any of its attorneys designated by it for such purpose1 without first referring the matter to the ,attorney ,general4 7#c7 ,rulemaking authority 7,a7 ,in general ,the ,commission shall have authority under section #eec of title #e1 ,united ,states ,code1 to promulgate any regulations necessary to implement this ,act4 7,b7 ,consultation ,in promulgating any regulations under this ,act1 the ,commission shall consult with the ,secretary4 7#d7 ,common carriers and nonprofit organizations ,notwithstanding section #d1 #e7;a77#b71 or #f of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd2 #de7;a77#b72 #df7 or any jurisdictional limitation of the ,commission1 the ,commission shall also enforce this ,act1 in the same manner provided in paragraphs 7#a7 and 7#b7 of this paragraph1 with respect to-- 7,a7 common carriers subject to the ,acts to regulate commerce1 air carriers1 and foreign air carriers subject to part ,a of subtitle ,,vii of title #di1 and persons1 partnerships1 or corporations insofar as they are subject to the ,packers and ,stockyards ,act1 #aiba 7#g ,u4,s4,c4 #aha et seq471 except as provided in section #djf7;b7 of such ,act 7#g ,u4,s4,c4 #bbg7;b772 and 7,b7 organizations not organized to carry on business for their own profit or that of their members4 7b7 ,enforcement by ,states 7#a7 ,in general ,in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of the ,state has been or is threatened or adversely affected by the engagement of any person subject to this ,act in a practice that violates such subsection1 the attorney general of the ,state may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states to obtain appropriate relief4 7#b7 ,rights of the ,federal ,trade ,commission 7,a7 ,notice to ,federal ,trade ,commission 7i7 ,in general ,except as provided in clause 7iii71 the attorney general of a ,state shall notify the ,commission in writing that the attorney general intends to bring a civil action under paragraph 7#a7 before initiating the civil action against a person subject to this ,act4 7ii7 ,contents ,the notification required by clause 7i7 with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action4 7iii7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notification required by clause 7i7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately upon instituting the civil action4 7,b7 ,intervention by the ,federal ,trade ,commission ,the ,commission may-- 7i7 intervene in any civil action brought by the attorney general of a ,state under paragraph 7#a72 and 7ii7 upon intervening-- 7,i7 be heard on all matters arising in the civil action2 and 7,,ii7 file petitions for appeal of a decision in the civil action4 7,c7 ,investigatory powers ,nothing in this subsection may be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7#c7 ,action by the ,federal ,trade ,commission ,if the ,commission institutes a civil action with respect to a violation of this ,act1 the attorney general of a ,state may not1 during the pendency of such action1 bring a civil action under paragraph 7#a7 of this subsection against any defendant named in the complaint of the ,commission for the violation with respect to which the ,commission instituted such action4 7#d7 ,venue2 service of process 7,a7 ,venue ,any action brought under paragraph 7#a7 may be brought in-- 7i7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7ii7 another court of competent jurisdiction4 7,b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which the defendant-- 7i7 is an inhabitant2 or 7ii7 may be found4 7,c7 ,actions by other ,state officials 7i7 ,in general ,in addition to civil actions brought by attorneys general under paragraph 7#a71 any other officer of a ,state who is authorized by the ,state to do so may bring a civil action under paragraph 7#a71 subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general4 7ii7 ,savings provision ,nothing in this subsection may be construed to prohibit an authorized official of a ,state from initiating or continuing any proceeding in a court of the ,state for a violation of any civil or criminal law of the ,state4 7c7 ,private right of action 7#a7 ,enforcement by individuals 7,a7 ,in general ,any individual alleging a violation of this ,act may bring a civil action in any court of competent jurisdiction1 ,state or ,federal4 7,b7 ,relief ,in a civil action brought under paragraph 7#a7 in which the plaintiff prevails1 the court may award-- 7i7 an amount not less than #ajj and not greater than #a1jjj per violation against any person who negligently violates a provision of this ,act2 7ii7 an amount not less than #ejj and not greater than #e1jjj per violation against any person who recklessly1 willfully1 or intentionally violates a provision of this ,act2 7iii7 reasonable attorney's fees and litigation costs2 and 7iv7 any other relief1 including equitable or declaratory relief1 that the court determines appropriate4 7,c7 ,injury in fact ,a violation of this ,act with respect to the emergency health data of an individual constitutes a concrete and particularized injury in fact to that individual4 7#b7 ,invalidity of pre-dispute arbitration agreements and pre-dispute joint action waivers 7,a7 ,in general ,notwithstanding any other provision of law1 no pre-dispute arbitration agreement or pre-dispute joint action waiver shall be valid or enforceable with respect to a dispute arising under this ,act4 7,b7 ,applicability ,any determination as to whether or how this subsection applies to any dispute shall be made by a court1 rather than an arbitrator1 without regard to whether such agreement purports to delegate such determination to an arbitrator4 7,c7 ,definitions ,in this subsection3 7i7 ,the term pre-dispute arbitration agreement means any agreement to arbitrate a dispute that has not arisen at the time of making the agreement4 7ii7 ,the term pre-dispute joint-action waiver means an agreement1 whether or not part of a pre-dispute arbitration agreement1 that would prohibit1 or waive the right of1 one of the parties to the agreement to participate in a joint1 class1 or collective action in a judicial1 arbitral1 administration1 or other forum1 concerning a dispute that has not yet arisen at the time of making the agreement4 7iii7 ,the term dispute means any claim related to an alleged violation of this ,act and between an individual and a covered organization4 #g4 ,nonpreemption ,nothing in this ,act shall preempt or supersede1 or be interpreted to preempt or supersede1 any ,federal or ,state law or regulation1 or limit the authority of the ,commission or the ,secretary under any other provision of law4 #h4 ,effective date 7a7 ,in general ,this ,act shall apply beginning on the date that is #cj days after the date of enactment of this ,act4 7b7 ,authority ,to promulgate regulations and take certain other actions ,nothing in subsection 7a7 affects-- 7#a7 the authority of any person to take an action expressly required by a provision of this ,act before the effective date described in such subsection2 or 7#b7 the authority of the ,commission to promulgate regulations to implement this ,act or begin a rulemaking to promulgate such regulations4