,,ii  #aag? ,,congress  #a/ ,session    
,s4 #bd  ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$
 ,,/ates  ,janu>y #bb1 #bjba,ms4        
,klobu*> 7= h]self & ,ms4 ,murk[ski7    
introduc$ ! foll[+ bill2 :i* 0 read     
twice & ref]r$ to ! ,committee on       
,heal?1 ,education1 ,labor1 & ,p5sions  
,a ,,bill  ,to protect ! p]sonal heal?  
data ( all ,am]icans4  #a4 ,%ort title  
,?is ,act may be cit$ z ! ,protect+     
,p]sonal ,heal? ,data ,act4  #b4 ,f9d+s 
,congress f9ds z foll[s3 7#a7 ,on ,july 
#ai1 #bjaf1 ! ,dep>tm5t ( ,heal? &      
,human ,s]vices1 act+ ?r\gh ! ,(fice ( !
 ,national ,coord9ator = ,heal?         
,in=mation ,te*nology & 9 coord9ation ) 
! ,(fice = ,civil ,rights ( ! ,dep>tm5t 
( ,heal? & ,human ,s]vices & ! ,f$]al   
,trade ,commission1 issu$ a report to   
,congress entitl$ ,exam9+ ,ov]sight ( ! 
,privacy  ,security ( ,heal? ,data      
,collect$ by ,entities ,n ,regulat$ by  
,,hipaa 7ref]r$ to 9 ?is section z !    
report7 ab\t ! ne$ to enact mod]n       
protections = consum]s' p]sonal heal?   

data4  7#b7 ,! report /ates t the       
we>able fitness track]s1 social m$ia    
sites :]e individuals %>e heal?         
in=mation ?r\gh specific social         
networks1 & o!r te*nologies t are common
 today did n exi/ :5 ,congress enact$ ! 
,heal? ,insurance ,portability &        
,acc\ntability ,act ( #aiif4  7#c7 ,!   
report /ates t entities n cov]$ by !    
privacy protections ( ! ,heal?          
,insurance ,portability & ,acc\ntability
 ,act ( #aiif 7,public ,law #ajd-aia71  
su* z we>able fitness track]s &         
heal?-focus$ social m$ia sites1 engage 9
 a v>iety ( practices su* z onl9e       
adv]tis+ & m>ket+1 comm]cial uses or    
sale ( individual in=mation1 &          
behavioral track+ practices1 all ( :i*  
indicate in=mation use t is likely      
broad] ?an :at individuals w\ld         
anticipate4  7#d7 ,! report id5tifies   
key gaps t exi/ betwe5 ,,hipaa regulat$ 
entities & ^? n regulat$ by ,,hipaa &   
recomm5ds address+ ^? gaps 9 a way t    
protects consum]s :ile level+ ! play+   

field = innovators inside & outside (   
,,hipaa4  #c4 ,def9itions ,9 ?is ,act3  
7#a7 ,consum] devices1 s]vices1         
applications1 & s(tw>e  7,a7 ,9 g5]al   
,except z provid$ 9 subp>agraph 7,c71 ! 
t]m consum] devices1 s]vices1           
applications1 & s(tw>e means devices1   
s]vices1 applications1 & s(tw>e-- 7i7 t 
are prim>ily design$ = or m>ket$ to     
consum]s2 &  7ii7 a sub/antial purpose  
or use ( :i* is to collect or use       
p]sonal heal? data4  7,b7 ,inclusion ,! 
t]m consum] devices1 s]vices1           
applications1 & s(tw>e %all include1 b  
is n limit$ to-- 7i7 direct-to-consum]  
g5etic te/+ s]vices2  7ii7 cl\d-bas$ or 
mobile te*nologies t are design$ to     
collect individuals' p]sonal heal? data 
directly or indirectly ) individuals'   
cons5t1 :i* c\ld enable %>+ ( su*       
in=mation1 su* z we>able fitness        
track]s2 &  7iii7 int]net-bas$ social   
m$ia sites :i* are prim>ily design$ =1  
or m>ket$ to1 consum]s to collect or use
 p]sonal heal? data1 includ+ sites t %>e

 heal? conditions & exp]i5ces4  7,c7    
,exception ,! t]m consum] devices1      
s]vices1 applications1 & s(tw>e %all n  
include-- 7i7 products on :i* p]sonal   
heal? data is d]iv$ solely f o!r        
in=mation t is n p]sonal heal? data1 su*
 z ,global ,position+ ,sy/em data2 or   
7ii7 products prim>ily design$ =1 or    
m>ket$ to1 cov]$ entities & bus9ess     
associates 7z def9$ = purposes (        
regulations promulgat$ "u section       
#bfd7;c7 ( ! ,heal? ,insurance          
,portability & ,acc\ntability ,act (    
#aiif 7#db ,u4,s4,c4 #acbj;d-#b note774 
7#b7 ,direct-to-consum] g5etic te/+     
s]vices ,! t]m direct-to-consum] g5etic 
te/+ s]vice means a s]vice1 :i* may     
include a te/ t analyzes v>i\s aspects (
 an individual's g5etic mat]ial1 t      
enables a consum] to h access to _!     
g5etic in=mation1 or to in=mation d]iv$ 
!refrom1 )\t ! ne$ to h a heal? c>e     
provid] or heal? insurance issu]        
p>ticipate 9 ! process ( ga9+ access4   
7#c7 ,national coord9ator ,! t]m        

,national ,coord9ator means ! ,national 
,coord9ator = ,heal? ,in=mation         
,te*nology at ! ,dep>tm5t ( ,heal? &    
,human ,s]vices4  7#d7 ,op]ator ,! t]m  
op]ator means any p]son :o op]ates any  
type ( consum] devices1 s]vices1        
applications1 & s(tw>e or :o provides   
consum] devices1 s]vices1 applications1 
& s(tw>e = ! use ( consum]s & collects  
or ma9ta9s p]sonal heal? data f or ab\t 
! us]s ( su* consum] devices1 s]vices1  
applications1 & s(tw>e4  7#e7 ,p]sonal  
heal? data ,! t]m p]sonal heal? data    
means any in=mation1 includ+ g5etic     
in=mation1 :e!r oral or record$ 9 any =m
 or m$ium1 t relates to ! pa/1 pres5t1  
or future physical or m5tal heal? or    
condition ( an individual & t id5tifies 
! individual or ) respect to :i* !re is 
a reasonable basis to believe t !       
in=mation c be us$ to id5tify !         
individual4  7#f7 ,secret>y ,! t]m      
,secret>y means ! ,secret>y ( ,heal? &  
,human ,s]vices4  #d4 ,promulgation (   
regulations = op]ators ( consum]        

devices1 s]vices1 applications1 & s(tw>e
  7a7 ,9 g5]al ,n lat] ?an #f mon?s aft]
 ! date on :i* ! report is submitt$ "u  
section #e7;d71 ! ,secret>y1 9          
consultation ) ! ,*airman ( ! ,f$]al    
,trade ,commission1 ! ,national         
,coord9ator1 relevant /akehold]s1 &     
heads ( su* o!r ,f$]al ag5cies z !      
,secret>y consid]s appropriate1 %all    
promulgate regulations to help /r5g!n   
privacy & security protections =        
consum]s' p]sonal heal? data t is       
collect$1 process$1 analyz$1 or us$ by  
consum] devices1 s]vices1 applications1 
& s(tw>e4  7b7 ,requirem5ts  7#a7 ,9    
g5]al ,! ,secret>y %all ensure t !      
regulations pursuant to subsection 7a7--
 7,a7 acc\nt = diff]5ces 9 ! nature &   
s5sitivity ( ! data collect$ or /or$ on 
! consum] device1 s]vice1 application1  
or s(tw>e2 &  7,b7 include su*          
def9itions = relevant t]ms t are        
necess>y to accompli% ! goals ( !       
regulations set =? 9 subsection 7a74    
7#b7 ,requirem5ts ( secret>y ,9 !       

promulgation ( regulations "u subsection
 7a71 ! ,secret>y1 to ! ext5t           
practicable1 %all-- 7,a7 consid] ! f9d+s
 9 ! report issu$ by ! ,dep>tm5t (      
,heal? & ,human ,s]vices to ,congress   
entitl$ ,exam9+ ,ov]sight ( ! ,privacy  
,security ( ,heal? ,data ,collect$ by   
,entities ,n ,regulat$ by ,,hipaa1      
includ+ f9d+s reg>d+ individuals' access
 rights1 re-use ( data by ?ird p>ties1  
security /&>ds applicable to data hold]s
 & us]s1 confusion or ambiguity reg>d+  
t]m9ology relat$ to privacy & security  
protections1 & ! adequacy ( collection1 
use1 & disclosure limitations2  7,b7    
consid] o!r regulations & guidance issu$
 by ! ,f$]al ,trade ,commission1 & o!r  
regulations promulgat$ "u section       
#bfd7;c7 ( ! ,heal? ,insurance          
,portability & ,acc\ntability ,act (    
#aiif 7#db ,u4,s4,c4 #acbj;d-#b note71  
subtitle ,d ( ! ,heal? ,in=mation       
,te*nology = ,economic & ,cl9ical ,heal?
 ,act 7#db ,u4,s4,c4 #agiba et seq471   
,g5etic ,in=mation ,nondiscrim9ation    

,act 7,public ,law #aaj-bcc1 #abb ,/at4 
#hha71 ! ,common ,rule z conta9$ 9 "p   
#df ( title #de1 ,code ( ,f$]al         
,regulations1 & o!r relat$ ,acts2  7,c7 
consi/5t ) p>agraph 7#c71 consid]       
appropriate uni=m /&>ds = cons5t relat$ 
to ! h&l+ ( g5etic data1 biometric data1
 & p]sonal heal? data2  7,d7 consid]    
exceptions to cons5t requirem5ts "u     
subp>agraph 7,c7 = purposes t may       
include law en=cem5t1 academic rese>* or
 rese>* = ! sole purpose ( assess+ heal?
 c>e utilization & outcomes1 em]g5cy    
m$ical treatm5t1 or det]m9+ pat]nity2   
7,e7 consid] appropriate m9imum /&>ds ( 
security t may diff] accord+ to ! nature
 & s5sitivity ( ! data collect$ or /or$ 
on1 or process$ or transf]r$ by1 !      
consum] device1 s]vice1 application1 or 
s(tw>e2  7,f7 consid] appropriate /&>ds 
= ! de-id5tification ( p]sonal heal?    
data2  7,g7 consid] appropriate         
limitations on ! collection1 use1 or    
disclosure ( p]sonal heal? data to t :i*
 is directly relevant & necess>y to     

accompli% a specifi$ purpose2  7,h7     
consult ) ! ,national ,coord9ator1 !    
,commission] ( ,food & ,drugs1 & !      
,*airman ( ! ,f$]al ,trade ,commission2 
&  7,i7 provide = initial & ongo+       
outrea* reg>d+ regulations affect+      
indu/ries1 bus9esses1 & individuals to  
ensure aw>5ess ( consum] privacy &      
security protections 9 ! field ( digital
 heal? te*nology4  7#c7 ,uni=m /&>ds ,9 
! review ( ea* ( ! areas describ$ 9     
p>agraph 7#b77;,c71 ! ,secret>y %all    
consid]-- 7,a7 ! developm5t ( /&>ds =   
obta9+ us] cons5t bas$ on h[ in=mation w
 be %>$ to ensure t prior to !          
collection1 analysis1 use1 or disclosure
 ( consum]s' p]sonal heal? data1 an     
op]ator ( a consum] device1 s]vice1     
application1 or s(tw>e specifies ! uses 
( ! p]sonal heal? data & :o w h access  
to ! in=mation2  7,b7 ! mann] 9 :i*     
cons5t is obta9$ 9 a way t uses cle>1   
concise1 & well-organiz$ language t is  
easily accessible1 ( reasonable l5g?1 at
 an appropriate level ( readability1 &  

cle>ly di/+ui%able f o!r matt]s2  7,c7 a
 process to limit ! transf] ( p]sonal   
heal? data to ?ird p>ties & provide     
consum]s ) great] control ov] h[ _!     
p]sonal heal? data is us$ = m>ket+      
purposes2  7,d7 second>y uses outside ( 
! prim>y purpose ( ! s]vice z initially 
indicat$ :5 cons5t 0 fir/ obta9$2  7,e7 
a process to p]mit a )drawal ( cons5t to
 ensure t a us] is able to remove cons5t
 = ! t]ms ( s]vice = use ( ! consum]    
device1 s]vice1 application1 or s(tw>e1 
includ+ ! collection & use ( p]sonal    
heal? data z easily z ! us] is able to  
give su* cons5t2  7,f7 provid+ a "r to  
access a copy ( ! p]sonal heal? data t !
 op]ator has collect$1 analyz$1 or us$1 
free ( *>ge & 9 an electronic & easily  
accessible =mat1 includ+ a li/ ( ea*    
entity t receiv$ ! p]sonal heal? data f 
! op]ator1 :e!r ?r\gh sale or o!r means2
 &  7,g7 provid+ a "r to delete & am5d  
p]sonal heal? data1 to ! ext5t          
practicable1 t ! op]ator has collect$1  
analyz$1 or us$4  7c7 ,updates ,!       

,secret>y %all review &1 if necess>y1   
update ! regulations promulgat$ "u      
subsection 7a7 9 accordance ) !         
requirem5ts "u subsection 7b74  7d7     
,public availability ,! ,dep>tm5t (     
,heal? & ,human ,s]vices %all make      
prom95tly available to ! public on !    
,dep>tm5t's int]net website1 cle> &     
concise in=mation ab\t available        
res\rces relat$ to ! regulations        
promulgat$ "u subsection 7a7 & all      
updates to su* res\rces4  7e7 ,consi/5cy
 ( res\rces publi%$ by ,f$]al ag5cies   
,if a ,f$]al ag5cy publi%es res\rces to 
help protect consum]s' p]sonal heal?    
data1 ! head ( su* ,f$]al ag5cy1 to !   
degree practicable1 %all make su*       
res\rces consi/5t ) ! regulations       
promulgat$ "u subsection 7a74  7f7 ,o!r 
,f$]al privacy & security requirem5ts   
,no?+ 9 ?is section %all be con/ru$ to  
sup]s$e1 alt]1 or o!rwise affect any    
privacy & security requirem5ts en=c$ by 
,f$]al ag5cies4  #e4 ,national task =ce 
on heal? data protection  7a7           

,e/abli%m5t ,! ,secret>y1 9 consultation
 ) ! ,*airman ( ! ,f$]al ,trade         
,commission1 ! ,national ,coord9ator1 & 
relevant /akehold]s1 %all e/abli% a task
 =ce1 to be kn[n z ! ,national ,task    
,=ce on ,heal? ,data ,protection 7ref]r$
 to 9 ?is section z ! ,task ,=ce74  7b7 
,duties ,! ,task ,=ce %all-- 7#a7 /udy !
 long-t]m effectiv5ess (                
de-id5tification me?odologies = g5etic  
data & biometric data2  7#b7 evaluate & 
provide input on ! developm5t ( security
 /&>ds1 includ+ encryption /&>ds &      
transf] protocols1 = consum] devices1   
s]vices1 applications1 & s(tw>e2  7#c7  
evaluate & provide input ) respect to   
address+ cyb]security risks & security  
conc]ns relat$ to consum] devices1      
s]vices1 applications1 & s(tw>e2  7#d7  
evaluate & provide input ) respect to ! 
privacy conc]ns & protection /&>ds      
relat$ to consum] & employee heal? data2
  7#e7 review & advise on ! ne$1 if any1
 to update ! report issu$ by ! ,dep>tm5t
 ( ,heal? & ,human ,s]vices to ,congress

 entitl$ ,exam9+ ,ov]sight ( ! ,privacy 
,security ( ,heal? ,data ,collect$ by   
,entities ,n ,regulat$ by ,,hipaa2 &    
7#f7 provide advice & consultation 9 !  
e/abli%m5t & dissem9ation ( res\rces to 
educate & advise consum]s ab\t ! basics 
( g5etics & direct-to-consum] g5etic    
te/+1 & ! risks1 b5efits1 & limitations 
( su* te/+4  7c7 ,memb]s ,! ,secret>y1 9
 consultation ) ! ,*airman ( ! ,f$]al   
,trade ,commission1 ! ,national         
,coord9ator1 & relevant /akehold]s1 %all
 appo9t n m ?an #ae memb]s to ! ,task   
,=ce4 ,9 appo9t+ su* memb]s1 ! ,secret>y
 %all ensure t ! total memb]%ip ( !     
,task ,=ce is an odd numb] & repres5ts a
 div]se set ( /akehold] p]spectives4    
7d7 ,report+ ,n lat] ?an #a ye> aft] !  
date ( enactm5t ( ?is ,act1 ! ,task ,=ce
 %all prep>e & submit to ! ,committee on
 ,comm]ce1 ,sci5ce1 & ,transportation ( 
! ,s5ate1 ! ,committee on ,heal?1       
,education1 ,labor1 & ,p5sions ( !      
,s5ate1 ! ,committee on ,homel&         
,security & ,gov]nm5tal ,affairs ( !    

,s5ate1 ! ,committee on ,en]gy &        
,comm]ce ( ! ,h\se ( ,repres5tatives1 ! 
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives1 ! ,secret>y1 ! 
,*airman ( ! ,f$]al ,trade ,commission1 
& ! ,commission] ( ,food & ,drugs1 a    
report on ! f9d+s ( ! ,task ,=ce4  7e7  
,au?orization ( appropriations ,!re are 
au?oriz$ to be appropriat$ su* sums z   
may be necess>y to c>ry out ?is section4
  7f7 ,f$]al ,advisory ,committee ,act  
,! ,f$]al ,advisory ,committee ,act 7#e 
,u4,s4,c4 ,app47 %all apply to ! ,task  
,=ce4  7g7 ,sunset  7#a7 ,9 g5]al ,!    
,task ,=ce %all t]m9ate on ! date t is  
#e ye>s aft] ! date ( ! fir/ meet+ ( !  
,task ,=ce4  7#b7 ,recomm5dation ,n lat]
 ?an ! date t is "o ye> prior to !      
t]m9ation ( ! ,task ,=ce "u p>agraph    
7#a71 ! ,secret>y %all submit to        
,congress a recomm5dation on :e!r !     
,task ,=ce %\ld be ext5d$4