,,ii  #aagth ,,congress  #b;d ,session  
,s4 #cfbj  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,february #i1  
#bjbb,mr4 ,cassidy 7for himself and ,ms4
 ,baldwin7 introduced the following     
bill2 which was read twice and referred 
to the ,committee on ,health1           
,education1 ,labor1 and ,pensions  ,a   
,,bill  ,to establish the ,commission   
for the ,comprehensive ,study of ,health
 ,data ,use and ,privacy ,protection4   
#a4 ,short title ,this ,act may be cited
 as the ,health ,data ,use and ,privacy 
,commission ,act4  #b4 ,findings2 rule  
of construction2 sense of congress  7a7 
,findings ,congress finds the following3
 7#a7 ,the people of the ,united ,states
 are increasingly concerned about their 
civil liberties and the confidentiality1
 security1 and use of their personal    
health information4  7#b7 ,commercial   
entities are increasingly aware that    
consumers expect them to adopt privacy  
policies and take appropriate steps to  
protect consumers' personal health      

information4  7#c7 ,due to a lack of    
,federal guidelines and a range of      
different ,state and local rules        
regarding privacy protection for        
individually identifiable health        
information1 there is a growing concern 
about the confidentiality of personal   
health information collected outside the
 context of health care delivery1       
payment1 and the practice of medicine   
generally4  7#d7 ,there is a need to    
ensure that accurate and timely health  
information flows to meet the needs of  
patients1 reduce costs in the health    
care system1 coordinate care1 and       
improve health care outcomes4  7#e7     
,access to accurate and complete health 
information is critical to ensure the   
equitable1 safe1 and effective delivery 
of care1 the development of novel       
treatments and cures1 the promotion of  
public health1 and the refinement of    
health care delivery4  7#f7 ,during the 
public health emergency with respect to 
,,covid-#ai declared by the ,secretary  

of ,health and ,human ,services under   
section #cai of the ,public ,health     
,service ,act 7#db ,u4,s4,c4 #bdg;d71   
some ,federal and ,state privacy rules  
have been waived1 modified1 or not      
enforced to help contain the pandemic4  
,as a result1 the ,,covid-#ai contagion 
has uncovered areas where current ,state
 and ,federal privacy rules may impede  
patient care1 public health management1 
and efforts to control the pandemic4    
,moreover1 the pandemic has spurred     
innovation including the development of 
new technologies and technology         
platforms that may not be covered by    
current regulatory constructs4  7#g7    
,privacy regulations promulgated under  
the ,health ,insurance ,portability and 
,accountability ,act of #aiif 7,public  
,law #ajd-aia7 have provided clearly    
defined responsibilities and enforcement
 for entities and business associates   
covered by such regulations1 however1   
the regulations should be assessed to   
account for the evolution of emerging   

technologies1 data and data management  
tools1 and the modernization of health  
care delivery4  7#h7 ,new rules and     
policies from the ,federal ,government  
encouraging the flow of health          
information to improve care and patient 
access to their own health information1 
including the rules promulgated under   
the #bast ,century ,cures ,act 7,public 
,law #aad-bee71 raise the issue of      
protected health information flowing to 
entities that are not subject to        
standardized privacy protections1       
including the privacy regulations       
promulgated under the ,health           
,information ,portability and           
,accountability ,act of #aiif 7,public  
,law #ajd-aia71 the ,health ,information
 ,technology for ,economic and ,clinical
 ,health ,act 7,public ,law #aaa-e7     
7including the amendments made by such  
,act71 and section #ddd of the ,general 
,education ,provisions ,act 7#bj        
,u4,s4,c4 #abcb;g2 commonly known as the
 ,family ,educational ,rights and       

,privacy ,act of #aigd74  7#i7 ,given   
the extensive proliferation of laws and 
proposals concerning the privacy of     
health information in light of recent   
changes in technology1 applications1    
social media1 and other platforms1 and  
the increasing generation1 collection1  
use1 sharing1 and selling of personal   
health information1 a coordinated and   
comprehensive review is necessary to    
evaluate the effectiveness of existing  
protections of personal health          
information compiled by the health care1
 insurance1 financial services1 consumer
 electronics1 advertising1 technology1  
and other industries4  7#aj7 ,use of the
 internet as a medium for commercial1   
social1 and health related activities   
will continue to grow1 and more data1   
including personal health information1  
will be generated1 exchanged1 and used  
by an increasing number of entities     
engaged in the digital marketplace4     
7#aa7 ,an increasing number of people of
 the ,united ,states are using consumer 

health technologies1 including wearable 
technology1 with about #bj percent of   
people of the ,united ,states reporting 
using such technology in #bjbj1 and     
generating data about their personal    
health and well-being4  7#ab7 ,the      
,united ,states is the leading economic 
and social force in the global          
information economy1 and it is important
 for the ,united ,states to continue    
that leadership4 ,as countries and      
governing bodies around the world       
continue to establish privacy standards1
 these standards will directly affect   
the ,united ,states4  7#ac7 ,the shift  
from an industry-focused economy to an  
information-focused economy calls for a 
swift reassessment of the most effective
 ways to balance personal privacy       
against information use for legitimate  
purposes1 keeping in mind the potential 
for unintended effects on technology and
 product development1 innovation1 and   
medical research4  7b7 ,rule of         
construction ,this ,act shall not be    

construed to prohibit the enactment of  
privacy legislation by ,congress during 
the existence of the ,commission on     
,health ,data ,use and ,privacy         
,protection established under section   
#c4  7c7 ,sense of congress ,it is the  
sense of ,congress that-- 7#a7 it is the
 responsibility of ,congress to act to  
protect the privacy of individuals1     
including individuals' medical          
information1 and to foster the          
improvement our ,nation's health care   
system2 and  7#b7 further study by the  
,commission established under section #c
 should not be considered a prerequisite
 for further consideration or enactment 
of health privacy or other related      
privacy legislation by ,congress4  #c4  
,establishment ,there is established a  
commission to be known as the           
,commission on ,health ,data ,use and   
,privacy ,protection 7referred to in    
this ,act as the ,commission74  #d4     
,duties of ,commission  7a7 ,study ,the 
,commission shall conduct a study of    

issues relating to protection of        
individual privacy and the appropriate  
balance to be achieved between          
protecting individual privacy and       
allowing and advancing appropriate uses 
of personal health information1         
including the following issues3 7#a7    
,the monitoring1 collection1 and        
distribution of personal health         
information by ,federal1 ,state1 and    
local governments1 such as the          
collection of information to combat the 
spread of infectious diseases such as   
,,covid-#ai1 the threat of substance use
 disorders involving opioids and other  
substances1 and other public health     
threats and benefits4  7#b7 ,current    
efforts to address the access1 exchange1
 and use of personal health information 
by ,federal and ,state governments1     
individuals1 or entities1 including--   
7,a7 existing statutes and regulations  
relating to the protection of individual
 privacy1 such as section #eeb;a of     
title #e1 ,united ,states ,code         

7commonly known as the ,privacy ,act of 
#aigd71 section #eeb of title #e1       
,united ,states ,code 7commonly known as
 the ,freedom of ,information ,act71 the
 ,federal ,trade ,commission ,act 7#ae  
,u4,s4,c4 #db et seq471 the ,common     
,rule and other applicable regulations  
promulgated under the ,health           
,information ,portability and           
,accountability ,act of #aiif 7,public  
,law #ajd-aia71 the ,health ,information
 ,technology for ,economic and ,clinical
 ,health ,act 7,public ,law #aaa-e7     
7including the amendments made by such  
,act71 the #bast ,century ,cures ,act   
7,public ,law #aad-bee7 7including the  
amendments made by such ,act71 and      
section #ddd of the ,general ,education 
,provisions ,act 7#bj ,u4,s4,c4 #abcb;g2
 commonly known as the ,family          
,educational ,rights and ,privacy ,act  
of #aigd72  7,b7 relevant legislation   
pending before ,congress and ,state     
legislatures2  7,c7 privacy protection  
efforts undertaken by-- 7i7 the ,federal

 ,government2  7ii7 ,state governments2 
or  7iii7 foreign governments and       
international governing bodies2  7,d7   
privacy protection efforts undertaken by
 the private sector1 including any      
relevant recommendations1 frameworks1 or
 proposals2 and  7,e7 self-regulatory   
efforts initiated or proposed by the    
private sector to respond to privacy    
issues4  7#c7 ,the differences and      
similarities between ,federal1 ,state1  
and international rules for protecting  
the privacy of health information and   
the degree to which such similarities or
 differences create or address problems 
related to collecting1 sharing1 and     
using health information to improve care
 and lower costs1 and any trade-offs    
related to patient privacy and patient  
control over health information4  7#d7  
,the need for consistency in            
deidentification standards for health   
data to avoid conflicting requirements  
that could impede the improvement of    
health care through clinical trials1    

technology development1 public health   
surveillance1 monitoring of general     
health trends1 and medical research4    
7#e7 ,technologies and data currently   
used for treatment1 payment1 and health 
care operations1 compared with          
technologies used when the privacy      
regulations promulgated under section   
#bfd of the ,health ,insurance          
,portability and ,accountability ,act of
 #aiif 7#db ,u4,s4,c4 #acbj;d-#b note7  
were first issued1 including an         
assessment of any gaps in the privacy   
protections under such regulations      
resulting from data collection and use  
by non-covered entities1 taking into    
account recommendations of the ,national
 ,committee on ,vital and ,health       
,statistics and the ,office for the     
,national ,coordinator for ,health      
,information ,technology4  7#f7 ,the    
monitoring1 collection1 and distribution
 of personal information by individuals 
or entities1 including access to1 and   
use of1 personal health information and 

medical records1 and the ability to     
access and restrict the information4    
7#g7 ,employer practices and policies   
with respect to the health information  
of employees1 including-- 7,a7 the      
extent to which employers collect1 use1 
or disclose employee health information 
for marketing1 employment1 or insurance 
underwriting purposes2  7,b7 what       
restrictions employers place on         
disclosure or use of employee health    
information2 and  7,c7 practices of     
employer medical departments with       
respect to disclosing employee health   
information to administrative or other  
personnel of the employer4  7#h7        
,current enforcement of privacy laws and
 rules through the ,federal ,trade      
,commission1 the ,office for ,civil     
,rights of the ,department of ,health   
and ,human ,services1 the ,civil ,rights
 ,division of the ,department of        
,justice1 ,state agencies 7including    
,state attorneys general71 and private  
rights of action4 ,such evaluation shall

 include an examination of efficacy1    
recommendations1 and advantages and     
disadvantages of different enforcement  
mechanisms1 and the potential for       
consolidation of enforcement4  7#i7     
,varying notices of privacy practices   
and whether such practices are effective
 in informing consumers of their rights 
and responsibilities1 including1 as     
appropriate1 an assessment of best      
practices4  7#aj7 ,varying statutory and
 regulatory employee training           
requirements1 including1 as appropriate1
 an assessment of best practices and    
whether harmonized training requirements
 may be more effective in encouraging   
efficient and effective training of     
employees in sound practices concerning 
personal health data4  7#aa7 ,challenges
 and potential solutions to consent     
requirements and processes1 particularly
 related to medical research4  7#ab7    
,the degree to which personal health    
information is sold with or without     
consent1 and the uses of such           

information4  7b7 ,field hearings ,the  
,commission may conduct field hearings  
in the ,united ,states4  7c7 ,report    
7#a7 ,in general ,not later than #f     
months after the appointment of all     
members of the ,commission-- 7,a7 a     
majority of the members of the          
,commission shall approve a report      
described in paragraph 7#b72 and  7,b7  
the ,commission shall submit the        
approved report to the ,committee on    
,health1 ,education1 ,labor1 and        
,pensions of the ,senate1 the ,committee
 on ,energy and ,commerce of the ,house 
of ,representatives1 the ,secretary of  
,health and ,human ,services1 and the   
,president4  7#b7 ,contents ,the report 
required under paragraph 7#a7 shall     
include a detailed statement of         
findings1 conclusions1 and              
recommendations1 including the          
following3 7,a7 ,findings from the study
 conducted by the ,commission pursuant  
to section #d7;a71 including potential  
threats posed to individual health      

privacy and to legitimate business and  
policy interests4  7,b7 ,analysis of    
purposes for which sharing of health    
information is appropriate and          
beneficial to consumers and the threat  
to health outcomes and costs if privacy 
rules are too stringent4  7,c7 ,analysis
 of the effectiveness of existing       
statutes1 regulations1 private sector   
self-regulatory efforts1 technology     
advances1 and market forces in          
protecting individual health privacy4   
7,d7 ,recommendations on whether        
,federal legislation is necessary1 and  
if so1 specific suggestions on proposals
 to reform1 streamline1 harmonize1      
unify1 or augment current laws and      
regulations relating to individual      
health privacy1 including reforms or    
additions to existing law related to    
enforcement1 preemption1 consent1       
penalties for misuse1 transparency1 and 
notice of privacy practices4  7,e7      
,analysis of whether additional         
regulations may impose costs or burdens1

 or cause unintended consequences in    
other policy areas1 such as security1   
law enforcement1 medical research1      
health care cost containment1 improved  
patient outcomes1 public health1 or     
critical infrastructure protection1 and 
whether such costs or burdens are       
justified by the additional regulations 
or benefits to privacy1 including       
whether such benefits may be achieved   
through less onerous means4  7,f7 ,cost 
analysis of legislative or regulatory   
changes proposed in the report4  7,g7   
,recommendations on non-legislative     
solutions to individual health privacy  
concerns1 including education1          
market-based measures1 industry best    
practices1 and new technologies4  7,h7  
,review of the effectiveness and utility
 of third-party statements of privacy   
principles and private sector           
self-regulatory efforts1 as well as     
third-party certification or            
accreditation programs meant to ensure  
compliance with privacy requirements4   

7d7 ,additional report ,together with   
the report under subsection 7c71 the    
,commission shall submit to ,congress   
and the ,president any additional report
 of dissenting opinions or minority     
views by a member or members of the     
,commission4  7e7 ,interim report ,the  
,commission may submit to ,congress and 
the ,president an interim report        
approved by a majority of the members of
 the ,commission4  #e4 ,membership  7a7 
,number and appointment ,the ,commission
 shall-- 7#a7 be composed of #ag members
 to be appointed by the ,comptroller    
,general2 and  7#b7 reflect the views of
 health providers1 ancillary health care
 workers1 health care purchasers1 health
 plans1 health technology developers1   
researchers1 consumers1 public health   
experts1 civil liberties experts1       
genomics experts1 educators1 the        
consumer electronics industry1 and      
relevant ,federal agencies1 and other   
entities as the ,secretary of ,health   
and ,human ,services determines         

appropriate4  7b7 ,terms ,each member of
 the ,commission shall be appointed for 
the life of the ,commission4  7c7       
,vacancies ,a vacancy in the ,commission
 shall be filled in the same manner in  
which the original appointment was made4
  7d7 ,compensation2 travel expenses    
,members of the ,commission shall serve 
without pay1 but shall receive travel   
expenses1 including per diem in lieu of 
subsistence1 in accordance with sections
 #egjb and #egjc of title #e1 ,united   
,states ,code4  7e7 ,quorum ,a majority 
of the members of the ,commission shall 
constitute a quorum1 but a lesser number
 may hold hearings4  7f7 ,meetings  7#a7
 ,in general ,the ,commission shall meet
 at the call of the ,chair or a majority
 of its members4  7#b7 ,initial meeting 
,not later than #fj days after the date 
of the enactment of this ,act1 the      
,commission shall hold its initial      
meeting4  7#c7 ,virtual or in-person    
meetings ,meetings may be held in person
 or virtually4  7g7 ,ethical disclosure 

,the ,comptroller ,general shall        
establish a system for public disclosure
 by members of the ,commission of       
financial and other potential conflicts 
of interest relating to such members4   
,members of the ,commission shall be    
treated as employees of ,congress for   
purposes of applying title ,i of the    
,ethics in ,government ,act of #aigh 7#e
 ,u4,s4,c4 ,app474  #f4 ,director2      
staff2 experts and consultants  7a7     
,director  7#a7 ,in general ,not earlier
 than #de days after the date of        
enactment of this ,act1 the ,commission 
shall appoint a ,director of the        
,commissioner 7referred to in this ,act 
as the ,director7 without regard to the 
provisions of title #e1 ,united ,states 
,code1 governing appointments to the    
competitive service4  7#b7 ,pay ,the    
,director shall be paid at the rate     
payable for level ,,iii of the          
,executive ,schedule established under  
section #ecad of title #e1 ,united      
,states ,code4  7b7 ,staff ,the         

,director may appoint staff as the      
,director determines appropriate4  7c7  
,applicability of certain civil service 
laws  7#a7 ,in general ,the staff of the
 ,commission shall be appointed without 
regard to the provisions of title #e1   
,united ,states ,code1 governing        
appointments in the competitive service4
  7#b7 ,pay ,the staff of the           
,commission shall be paid in accordance 
with the provisions of chapter #ea and  
subchapter ,,iii of chapter #ec of that 
title relating to classification and    
,general ,schedule pay rates1 but at    
rates not in excess of the maximum rate 
for grade ,,gs-#ae of the ,general      
,schedule under section #eccb of that   
title4  7d7 ,experts and consultants    
,the ,director may procure temporary and
 intermittent services under section    
#caji7;b7 of title #e1 ,united ,states  
,code4  7e7 ,staff of ,federal agencies 
7#a7 ,in general ,upon request of the   
,director1 the head of any ,federal     
department or agency may detail1 on a   

reimbursable basis1 any of the personnel
 of that department or agency to the    
,commission to assist it in carrying out
 this ,act4  7#b7 ,notification ,before 
making a request under this subsection1 
the ,director shall give notice of the  
request to each member of the           
,commission4  #g4 ,powers of ,commission
  7a7 ,hearings and sessions ,the       
,commission may1 for the purpose of     
carrying out this ,act1 hold hearings1  
sit and act at times and places1 take   
testimony1 and receive evidence as the  
,commission considers appropriate4 ,the 
,commission may administer oaths or     
affirmations to witnesses appearing     
before it4  7b7 ,powers of members and  
agents ,any member or agent of the      
,commission may1 if authorized by the   
,commission1 take any action which the  
,commission is authorized to take by    
this section4  7c7 ,obtaining official  
information  7#a7 ,in general ,except as
 provided in paragraph 7#b71 if the     
,chair of the ,commission submits a     

request to a ,federal department or     
agency for information necessary to     
enable the ,commission to carry out this
 ,act1 the head of that department or   
agency shall furnish that information to
 the ,commission4  7#b7 ,exception for  
national security ,if the head of the   
department or agency determines that it 
is necessary to guard such information  
from disclosure to protect the national 
security interests of the ,united       
,states1 the head shall not furnish that
 information to the ,commission4  7d7   
,mails ,the ,commission may use the     
,united ,states mails in the same manner
 and under the same conditions as other 
departments and agencies of the ,united 
,states4  7e7 ,administrative support   
services ,upon the request of the       
,director1 the ,administrator of        
,general ,services shall provide to the 
,commission1 on a reimbursable basis1   
the administrative support services     
necessary for the ,commission to carry  
out this ,act4  7f7 ,gifts and donations

 ,the ,commission may accept1 use1 and  
dispose of gifts or donations of        
services or property to carry out this  
,act1 but only to the extent or in the  
amounts provided in advance in          
appropriation ,acts4  7g7 ,contracts    
,the ,commission may contract with and  
compensate persons and government       
agencies for supplies and services1     
without regard to section #cgji of the  
,revised ,statutes 7#da ,u4,s4,c4 #e74  
7h7 ,subpoena power  7#a7 ,in general   
,the ,commission may issue subpoenas    
requiring the attendance and testimony  
of witnesses and the production of any  
evidence relating to any matter that the
 ,commission is empowered to investigate
 by section #d4 ,the attendance of      
witnesses and the production of evidence
 may be required by such subpoena from  
any place within the ,united ,states and
 at any specified place of hearing      
within the ,united ,states4  7#b7       
,failure to obey a subpoena ,if a person
 refuses to obey a subpoena issued under

 paragraph 7#a71 the ,commission may    
apply to a ,united ,states district     
court for an order requiring that person
 to appear before the ,commission to    
give testimony1 produce evidence1 or    
both1 relating to the matter under      
investigation4 ,the application may be  
made within the judicial district where 
the hearing is conducted or where that  
person is found1 resides1 or transacts  
business4 ,any failure to obey the order
 of the court may be punished by the    
court as civil contempt4  7#c7 ,service 
of subpoenas ,the subpoenas of the      
,commission shall be served in the      
manner provided for subpoenas issued by 
a ,united ,states district court under  
the ,federal ,rules of ,civil ,procedure
 for the ,united ,states district       
courts4  7#d7 ,service of process ,all  
process of any court to which           
application is made under paragraph 7#b7
 may be served in the judicial district 
in which the person required to be      
served resides or may be found4  #h4    

,termination ,the ,commission shall     
terminate #cj days after submitting a   
report under section #d7;c74  #i4       
,authorization of appropriations  7a7   
,in general ,there are authorized to be 
appropriated to the ,commission such    
sums as may be necessary to carry out   
this ,act4  7b7 ,availability ,any sums 
appropriated pursuant to the            
authorization in subsection 7a7 shall   
remain available until expended4  #aj4  
,budget act compliance ,any new contract
 authority authorized by this ,act shall
 be effective only to the extent or in  
the amounts provided in advance in      
appropriation ,acts4  #aa4 ,privacy     
protections  7a7 ,destruction or return 
of information required ,upon the       
conclusion of the matter or need for    
which individually identifiable         
information was disclosed to the        
,commission1 the ,commission shall      
either destroy the individually         
identifiable information or return it to
 the person or entity from which it was 

obtained1 unless the individual that is 
the subject of the individually         
identifiable information has authorized 
its disclosure4  7b7 ,disclosure of     
information prohibited ,the             
,commission-- 7#a7 shall protect        
individually identifiable information   
from improper use2 and  7#b7 may not    
disclose such information to any person1
 including ,congress or the ,president1 
unless the individual that is the       
subject of the information has          
authorized such a disclosure4  7c7      
,proprietary business information and   
financial information ,the ,commission  
shall protect from improper use1 and may
 not disclose to any person1 proprietary
 business information and proprietary   
financial information that may be viewed
 or obtained by the ,commission in the  
course of carrying out its duties under 
this ,act4