,,ii  #aah? ,,congress  #a/ ,session    
,s4 #fca  ,,9 ,,! ,,s5ate ,,( ,,!       
,,unit$ ,,/ates  ,m>* #b1 #bjbc ,ms4    
,klobu*> 7= h]self1 ,ms4 ,w>r51 & ,ms4  
,hirono7 introduc$ ! foll[+ bill2 :i* 0 
read twice & ref]r$ to ! ,committee on  
,comm]ce1 ,sci5ce1 & ,transportation  ,a
 ,,bill  ,to protect ! privacy (        
p]sonally id5tifiable heal? & location  
data1 & = o!r purposes4  #a4 ,%ort title
 ,?is ,act may be cit$ z ! ,uphold+     
,protections = ,heal? & ,onl9e ,location
 ,data ,privacy ,act ( #bjbc or !       
,,uphold ,privacy ,act ( #bjbc4  #b4    
,privacy ( heal? data  7a7 ,prohibition 
on ! use ( heal? data 9 comm]cial       
adv]tis+ ,x %all be unlawful = any cov]$
 entity to use ! heal? data ( an        
individual t is collect$ f any s\rce    
7includ+ data volunte]$ by an           
individual1 m$ical c5t]-d]iv$ data1 data
 f a we>able fitness track]1 data f web 
br[s+ hi/ory1 or any o!r s\rce det]m9$  
appropriate by ! ,commission7 =         
comm]cial adv]tis+4  7b7 ,m9imization ( 

collect+1 reta9+1 us+1 & disclos+ heal? 
data ,a cov]$ entity may n collect1     
reta91 use1 or disclose heal? data      
except-- 7#a7 ) ! express cons5t ( !    
individual to :om su* data relates2 or  
7#b7 z is /rictly necess>y to provide a 
product or s]vice t ! individual to :om 
su* data relates has reque/$ f su* cov]$
 entity4  7c7 ,m9imization ( employee   
access ,a cov]$ entity %all re/rict     
access to heal? data by any employee or 
s]vice provid] ( ! cov]$ entity to only 
su* an employee or s]vice provid] = :i* 
access is necess>y to provide a product 
or s]vice t ! individual to :om su* data
 relates has reque/$ f ! cov]$ entity4  
7d7 ,privacy policy  7#a7 ,policy       
requir$ ,a cov]$ entity %all ma9ta9 a   
privacy policy relat+ to ! practices (  
su* cov]$ entity reg>d+ ! collect+1     
reta9+1 us+1 & disclos+ ( heal? data4   
7#b7 ,publication requir$ ,if a cov]$   
entity has a website1 su* cov]$ entity  
%all prom95tly publi% ! privacy policy  
describ$ 9 p>agraph 7#a7 on su* website4

  7#c7 ,cont5ts ,! privacy policy       
describ$ 9 p>agraph 7#a7 %all be cle> & 
conspicu\s & conta91 at a m9imum1 !     
foll[+3 7,a7 ,a description ( !         
practices ( ! cov]$ entity reg>d+ !     
collect+1 reta9+1 us+1 & disclos+ (     
heal? data4  7,b7 ,a cle> & concise     
/atem5t ( ! categories ( su* data       
collect$1 reta9$1 us$1 or disclos$ by ! 
cov]$ entity4  7,c7 ,a cle> & concise   
/atem5t ( ! cov]$ entity's purposes = ! 
collect+1 reta9+1 us+1 or disclos+ ( su*
 data4  7,d7 ,a li/ ( ! specific ?ird   
p>ties to :i* ! cov]$ entity discloses  
su* data1 & a cle> & concise /atem5t ( !
 purposes = :i* ! cov]$ entity discloses
 su* data1 includ+ h[ ! data may be us$ 
by ea* su* ?ird p>ty4  7,e7 ,a li/ ( !  
specific ?ird p>ties f :i* ! cov]$      
entity has collect$ su* data1 & a cle> &
 concise /atem5t ( ! purposes = :i* !   
cov]$ entity collects su* data4  7,f7 ,a
 cle> & concise /atem5t describ+ ! ext5t
 to :i* an individual may ex]cise       
control ov] ! collect+1 reta9+1 us+1 &  

disclos+ ( heal? data by ! cov]$ entity1
 & ! /eps an individual mu/ take to     
implem5t su* controls4  7,g7 ,a cle> &  
concise /atem5t describ+ ! ef=ts ( !    
cov]$ entity to protect heal? data f    
unau?oriz$ disclosure4  #c4 ,unfair &   
deceptive acts & practices relat+ to    
location data  7a7 ,prohibition on sale 
f data brok]s ,x %all be unlawful = a   
data brok] to sell1 resell1 lic5se1     
trade1 transf]1 %>e1 or o!rwise provide 
or make available location data 7includ+
 data volunte]$ by an individual1 m$ical
 c5t]-d]iv$ data1 data f a we>able      
fitness track]1 data f web br[s+ hi/ory1
 or any o!r s\rce det]m9$ appropriate by
 ! ,commission74  7b7 ,prohibition on   
sale to data brok]s ,x %all be unlawful 
= any p]son to sell1 resell1 lic5se1    
trade1 transf]1 %>e1 or o!rwise provide 
or make available location data 7includ+
 data volunte]$ by an individual1 m$ical
 c5t]-d]iv$ data1 data f a we>able      
fitness track]1 data f web br[s+ hi/ory1
 or any o!r s\rce det]m9$ appropriate by

 ! ,commission7 to a data brok]4  #d4   
,"r ( access & deletion  7a7 ,"r (      
access  7#a7 ,9 g5]al ,a cov]$ entity   
%all make available a reasonable        
me*anism by :i* an individual1 ^u v]ifi$
 reque/1 may access-- 7,a7 any heal?    
data or location data relat+ to su*     
individual t is reta9$ by su* cov]$     
entity1 includ+--  7i7 9 ! case ( su*   
data t ! cov]$ entity collect$ f any    
?ird p>ty1 h[ & f :i* specific ?ird p>ty
 ! cov]$ entity collect$ su* data2 &    
7ii7 su* data t ! cov]$ entity inf]r$   
ab\t ! individual2 &  7,b7 a li/ ( !    
specific ?ird p>ties to :i* ! cov]$     
entity has disclos$ any heal? data or   
location data relat+ to su* individual4 
7#b7 ,=mat ,a cov]$ entity %all make !  
in=mation describ$ 9 p>agraph 7#a7      
available 9 bo? a human-readable & a    
/ructur$1 int]op]able1 & ma*9e-readable 
=mat4  7b7 ,"r ( deletion ,a cov]$      
entity %all make available a reasonable 
me*anism by :i* an individual1 ^u v]ifi$
 reque/1 may reque/ ! deletion ( any    

heal? data or location data relat+ to   
su* individual t is reta9$ by ! cov]$   
entity1 includ+ any su* in=mation t !   
cov]$ entity collect$ f a ?ird p>ty or  
inf]r$ f o!r in=mation reta9$ by ! cov]$
 entity4  7c7 ,requirem5ts = access &   
deletion  7#a7 ,timel9e = comply+ )     
reque/s ,a cov]$ entity %all comply ) a 
v]ifi$ reque/ receiv$ "u ?is section )\t
 undue delay1 b n lat] ?an #ae days aft]
 ! date on :i* ! cov]$ entity receives  
su* v]ifi$ reque/4  7#b7 ,fees prohibit$
 ,a cov]$ entity may n *>ge a fee to an 
individual = a reque/ made "u ?is       
section4  7#c7 ,rules ( con/ruction     
,no?+ 9 ?is section %all be con/ru$ to  
require a cov]$ entity to--  7,a7 take  
an action t w\ld conv]t in=mation t is n
 heal? data or location data into heal? 
data or location data2  7,b7 collect or 
reta9 heal? data or location data t !   
cov]$ entity w\ld n o!rwise collect or  
reta92 or  7,c7 reta9 heal? data or     
location data long] ?an ! cov]$ entity  
w\ld o!rwise reta9 su* data4  7d7       

,reasonable me*anism def9$ ,9 ?is       
section1 ! t]m reasonable me*anism      
means1 ) respect to a cov]$ entity & a  
"r "u ?is section1 a me*anism t--  7#a7 
is equival5t 9 availability & ease ( use
 to t ( o!r me*anisms = communicat+ or  
int]act+ ) ! cov]$ entity2 &  7#b7      
includes an onl9e means ( ex]cis+ any   
su* "r4  #e4 ,exceptions  7a7           
,publication ( newswor?y in=mation (    
legitimate public conc]n ,no?+ 9 ?is    
,act1 or a regulation promulgat$ "u ?is 
,act1 %all apply ) respect to heal? data
 or location data t is collect$1 reta9$1
 us$1 or disclos$ by a cov]$ entity = ! 
publication ( newswor?y in=mation (     
legitimate public conc]n to ! public1 or
 to ! collect+1 reta9+1 us+1 or disclos+
 ( su* data by a cov]$ entity = t       
purpose1 if su* cov]$ entity has        
reasonable safegu>ds & processes t      
prev5t ! collect+1 reta9+1 us+1 or      
disclos+ ( heal? data or location data =
 comm]cial purposes o!r ?an !           
publication ( newswor?y in=mation (     

legitimate public conc]n4  7b7 ,public  
heal? campaigns ,! prohibition "u       
section #b7;a7 %all n apply to any      
public heal? campaign direct$ t[>d      
individuals or subpopulations (         
individuals4  7c7 ,disclosure pursuant  
to valid au?orization  7#a7 ,9 g5]al    
,no?+ 9 ?is ,act %all be con/ru$ to     
prohibit a disclosure ( ! heal? data or 
location data ( an individual = :i* !   
individual provides valid au?orization4 
7#b7 ,valid au?orization def9$ ,=       
purposes ( p>agraph 7#a71 ! t]m valid   
au?orization has ! mean+ giv5 su* t]m 9 
section #afd4ejh ( title #de1 ,code (   
,f$]al ,regulations 7or a successor     
regulation71 subject to any su*         
adaptation ! ,commission %all deem      
necess>y to apply su* t]m to !          
disclosure ( bo? heal? data & location  
data4  7d7 ,,hipaa-,compliant actions   
7#a7 ,9 g5]al ,no?+ 9 ?is ,act %all be  
con/ru$ to prohibit any action tak5 )   
respect to ! heal? in=mation ( an       
individual by a data brok] t is a       

bus9ess associate or cov]$ entity t is  
p]missible "u ! ,f$]al regulations      
conc]n+ /&>ds = privacy ( individually  
id5tifiable heal? in=mation promulgat$  
"u section #bfd7;c7 ( ! ,heal?          
,insurance ,portability & ,acc\ntability
 ,act ( #aiif 7#db ,u4,s4,c4 #acbj;d-#b 
note74  7#b7 ,t]ms def9$ ,= purposes (  
p>agraph 7#a71 ! t]ms bus9ess associate1
 cov]$ entity1 & heal? in=mation %all h 
! mean+s giv5 ^? t]ms 9 ! ,f$]al        
regulations specifi$ 9 su* section      
#bfd7;c7 ( ! ,heal? ,insurance          
,portability & ,acc\ntability ,act (    
#aiif 7#db ,u4,s4,c4 #acbj;d-#b note74  
#f4 ,effective date  7a7 ,9 g5]al ,!    
prohibitions "u sections #b & #c %all   
take effect on ! e>li] (-- 7#a7 ! date !
 ,commission issues ! f9al rule "u      
subsection 7b72 or  7#b7 #ahj days aft] 
! date ( enactm5t ( ?is ,act4  7b7      
,rulemak+  7#a7 ,f9al rule ,n lat] ?an  
#ahj days aft] ! date ( enactm5t ( ?is  
,act1 ! ,commission %all promulgate     
regulations1 pursuant to section #eec ( 

title #e1 ,unit$ ,/ates ,code1 to c>ry  
out ! provisions ( ?is ,act4  7#b7      
,additional guidance ,! ,commission may 
promulgate fur!r regulations1 pursuant  
to su* section #eec1 to update & c>ry   
out ! provisions ( ?is ,act1 includ+    
fur!r guidance reg>d+ ! types ( data    
describ$ 9 sections #b & #c4  #g4       
,en=cem5t  7a7 ,en=cem5t by ! ,f$]al    
,trade ,commission  7#a7 ,unfair or     
deceptive acts or practices ,a violation
 ( section #b1 #c1 or #d %all be treat$ 
z a violation ( a rule def9+ an unfair  
or a deceptive act or practice "u       
section #ah7;a77#a77;,b7 ( ! ,f$]al     
,trade ,commission ,act 7#ae ,u4,s4,c4  
#eg;a7a77#a77;,b774  7#b7 ,p[]s ( !     
,commission  7,a7 ,9 g5]al ,except z    
provid$ 9 subp>agraphs 7,d7 & 7,e71 !   
,commission %all en=ce ?is ,act & any   
regulation promulgat$ !reund] 9 ! same  
mann]1 by ! same means1 & ) ! same      
jurisdiction1 p[]s1 & duties z ?\gh all 
applicable t]ms & provisions ( ! ,f$]al 
,trade ,commission ,act 7#ae ,u4,s4,c4  

#da et seq47 7 incorporat$ into & made a
 "p ( ?is ,act4  7,b7 ,privileges &     
immunities ,subject to subp>agraph 7,f71
 any cov]$ entity or data brok] :o      
violates ?is ,act or any regulation     
promulgat$ !reund] %all be subject to ! 
p5alties & entitl$ to ! privileges &    
immunities provid$ 9 ! ,f$]al ,trade    
,commission ,act 7#ae ,u4,s4,c4 #da et  
seq474  7,c7 ,au?ority pres]v$ ,no?+ 9  
?is ,act %all be con/ru$ to limit !     
au?ority ( ! ,f$]al ,trade ,commission  
"u any o!r provision ( law4  7,d7 ,scope
 ( jurisdiction ,not)/&+ section #d1    
#e7;a77#b71 or #f ( ! ,f$]al ,trade     
,commission ,act 7#ae ,u4,s4,c4 #dd1    
#de7;a77#b71 #df71 or any jurisdictional
 limitation ( ! ,commission1 !          
,commission %all also en=ce ?is ,act & !
 regulations promulgat$ "u ?is ,act1 9 !
 same mann] provid$ 9 subp>agraph 7,a71 
) respect to--  7i7 common c>ri]s       
subject to ! ,communications ,act (     
#aicd 7#dg ,u4,s4,c4 #aea et seq47 &    
,acts am5datory !re( & supplem5t>y      

!reto2 &  7ii7 organizations t are n    
organiz$ to c>ry on bus9ess = _! own    
pr(it or t ( _! memb]s4  7,e7 ,indep5d5t
 litigation au?ority ,9 any case 9 :i* !
 ,commission has reason to believe t a  
cov]$ entity or data brok] is violat+ or
 has violat$ section #b1 #c1 or #d1 !   
,commission may br+ a civil action1     
subject to subsection 7c71 to-- 7i7     
enjo9 any fur!r su* violation by su*    
cov]$ entity or data brok]2  7ii7 en=ce 
compliance ) ?is ,act1 includ+ ?r\gh    
deletion ( ! relevant in=mation2  7iii7 
obta9 a p]man5t1 tempor>y1 or prelim9>y 
injunction2  7iv7 obta9 civil p5alties2 
7v7 obta9 damages 7:e!r actual1         
punitive1 or o!rwise71 re/itution1      
disgorgem5t ( unju/ enri*m5t1 or o!r    
comp5sation on behalf ( aggriev$ p]sons2
 or  7vi7 obta9 any o!r appropriate     
equitable relief4  7,f7 ,civil p5alties 
,9 addition to any o!r p5alties z may be
 prescrib$ by law1 a violation ( ?is    
,act %all c>ry a civil p5alty n to exce$
 #ae p]c5t ( ! rev5ues e>n$ dur+ !      

prec$+ #ab-mon? p]iod by ! ultimate p>5t
 entity ( ! cov]$ entity or data brok] t
 committ$ su* violation4  7b7 ,private  
"r ( action  7#a7 ,9 g5]al ,any         
individual alleg+ a violation ( ?is ,act
 or a regulation promulgat$ !reund] may 
br+ a civil action1 subject to          
subsection 7c74  7#b7 ,relief ,9 a civil
 action br\ght "u p>agraph 7#a7 9 :i* ! 
pla9tiff prevails1 ! c\rt may aw>d--    
7,a7 damages 9 an am\nt equal to !      
great] (-- 7i7 actual damages2 or  7ii7 
an am\nt equal to n less ?an #ajj & n m 
?an #a1jjj p] violation1 p] day2  7,b7  
punitive damages2  7,c7 re/itution or   
o!r comp5sation2  7,d7 reasonable       
attorney's fees1 includ+ litigation     
exp5ses1 & co/s2 &  7,e7 any o!r relief 
det]m9$ appropriate by ! c\rt1 includ+  
equitable or decl>atory relief4  7#c7   
,injury 9 fact ,a violation ( ?is ,act  
or a regulation promulgat$ !reund] )    
respect to heal? data or location data  
con/itutes a concrete & p>ticul>iz$     
injury 9 fact to ! individual to :om su*

 data relates4  7#d7 ,invalidity (      
pre-dispute arbitration agreem5ts &     
pre-dispute jo9t-action waiv]s  7,a7 ,9 
g5]al ,not)/&+ any o!r provision ( law1 
no pre-dispute arbitration agreem5t or  
pre-dispute jo9t-action waiv] %all be   
valid or en=ceable ) respect to a       
dispute aris+ "u ?is ,act4  7,b7        
,applicability ,any det]m9ation z to    
:e!r or h[ ?is p>agraph applies to any  
dispute %all be made by a c\rt1 r ?an an
 arbitrator1 )\t reg>d to :e!r su*      
agreem5t purports to delegate su*       
det]m9ation to an arbitrator4  7,c7     
,def9itions ,= purposes ( ?is p>agraph3 
7i7 ,pre-dispute arbitration agreem5t ,!
 t]m pre-dispute arbitration agreem5t   
means any agreem5t to arbitrate a       
dispute t has n aris5 at ! "t ( ! mak+ (
 ! agreem5t4  7ii7 ,pre-dispute         
jo9t-action waiv] ,! t]m pre-dispute    
jo9t-action waiv] means an agreem5t t   
w\ld prohibit a p>ty f p>ticipat+ 9 a   
jo9t1 class1 or collective action 9 a   
judicial1 arbitral1 adm9i/rative1 or o!r

 =um1 conc]n+ a dispute t has n yet     
aris5 at ! "t ( ! mak+ ( ! agreem5t4    
7c7 ,exclusive jurisdiction  7#a7       
,di/rict c\rts ,= any action br\ght "u  
?is ,act1 ! foll[+ di/rict c\rts %all h 
exclusive jurisdiction3  7,a7           
,commission ,= actions br\ght by !      
,commission1 ! ,unit$ ,/ates ,di/rict   
,c\rt = ! ,di/rict ( ,columbia4  7,b7   
,private actions ,= private actions     
br\ght by individuals1 9 ! c\rt ( !     
pla9tiff's *oice betwe5--  7i7 ! ,unit$ 
,/ates ,di/rict ,c\rt = ! ,di/rict (    
,columbia2 or  7ii7 ! di/rict c\rt ( !  
,unit$ ,/ates = ! judicial di/rict 9 :i*
 ! violation took place or 9 :i* any    
def5dant resides or does bus9ess4  7#b7 
,c\rt ( appeals ,! ,unit$ ,/ates ,c\rt (
 ,appeals = ! ,di/rict ( ,columbia      
,circuit %all h exclusive jurisdiction (
 appeals f any decision "u p>agraph     
7#a74  7d7 ,/atute ( limitations ,an    
action = a violation ( ?is ,act may be  
comm5c$ n lat] ?an #f ye>s aft] ! date  
^u :i* ! pla9tiff obta9s actual k ( !   

facts giv+ rise to su* violation4  #h4  
,def9itions  7a7 ,9 g5]al ,9 ?is ,act3  
7#a7 ,collect ,! t]m collect means1 )   
respect to heal? data or location data1 
to obta9 su* data 9 any mann]4  7#b7    
,comm]cial adv]tis+ ,! t]m comm]cial    
adv]tis+ means communications t promote 
! sale ( or int]e/ 9 goods or s]vices1  
includ+ goods or s]vices t are publi%$  
digitally1 via video or audio1 or 9     
pr9t4  7#c7 ,commission ,! t]m          
,commission means ! ,f$]al ,trade       
,commission4  7#d7 ,cov]$ entity  7,a7  
,9 g5]al ,! t]m cov]$ entity means any  
entity t-- 7i7 is engag$ 9 activities 9 
or affect+ comm]ce 7z def9$ 9 section #d
 ( ! ,f$]al ,trade ,commission ,act 7#ae
 ,u4,s4,c4 #dd772 &  7ii7 is-- 7,i7 a   
p]son1 p>tn]%ip1 or corporation subject 
to ! jurisdiction ( ! ,commission "u    
section #e7;a77#b7 ( ! ,f$]al ,trade    
,commission ,act 7#ae ,u4,s4,c4         
#de7;a77#b772 or  7,,ii7 not)/&+ section
 #d1 #e7;a77#b71 or #f ( ! ,f$]al ,trade
 ,commission ,act 7#ae ,u4,s4,c4 #dd1   

#de7;a77#b71 #df7 or any jurisdictional 
limitation ( ! ,commission-- 7aa7 a     
common c>ri] subject to !               
,communications ,act ( #aicd 7#dg       
,u4,s4,c4 #aea et seq47 & all ,acts     
am5datory !re( & supplem5t>y !reto2 or  
7bb7 an organization n organiz$ to c>ry 
on bus9ess = its own pr(it or t ( its   
memb]s4  7,b7 ,exclusions ,! t]m cov]$  
entity does n include an entity t is--  
7i7 a cov]$ entity1 z def9$ 9 section   
#afj4ajc ( title #de1 ,code ( ,f$]al    
,regulations 7or a successor            
regulation71 to ! ext5t su* entity is   
act+ z a cov]$ entity "u ! ,,hipaa      
privacy regulations 7z def9$ 9 section  
#aahj7;b77#c7 ( ! ,social ,security ,act
 7#db ,u4,s4,c4 #acbj;d-#i7;b77#c7772   
7ii7 an entity t is a bus9ess associate1
 z def9$ 9 section #afj4ajc ( title #de1
 ,code ( ,f$]al ,regulations 7or a      
successor regulation71 to ! ext5t su*   
entity is act+ z a bus9ess associate "u 
! ,,hipaa privacy regulations 7z def9$ 9
 su* section #aahj7;b77#c772 or  7iii7  

an entity t is subject to re/rictions on
 disclosure ( records "u section #edc ( 
! ,public ,heal? ,s]vice ,act 7#db      
,u4,s4,c4 #bij;dd-#b71 to ! ext5t su*   
entity is act+ 9 a capacity subject to  
su* re/rictions4  7#e7 ,data brok] ,!   
t]m data brok] means an individual or   
entity t--  7,a7 collects1 buys1        
lic5ses1 or inf]s data ab\t an          
individual2 &  7,b7 sells1 lic5ses1 or  
trades su* data4  7#f7 ,disclose ,! t]m 
disclose means1 ) respect to heal? data 
or location data1 = a cov]$ entity to   
release1 transf]1 sell1 provide access  
to1 lic5se1 or divulge su* data 9 any   
mann] to a ?ird p>ty or gov]nm5t entity4
  7#g7 ,express cons5t  7,a7 ,9 g5]al ,!
 t]m express cons5t means1 ) respect to 
! collect+1 reta9+1 us+1 or disclos+ (  
heal? data or location data1 ! in=m$1   
opt$-91 volunt>y1 specific1 & unambigu\s
 writt5 cons5t ( an individual 7:i* may 
include writt5 cons5t provid$ by        
electronic means7 to su* collect+1      
reta9+1 us+1 or disclos+ ( su* data4    

7,b7 ,exclusions ,! t]m express cons5t  
does n include any ( ! foll[+3 7i7      
,cons5t secur$ )\t fir/ provid+ to !    
individual a cle> & conspicu\s          
disclosure1 ap>t f any privacy policy1  
t]ms ( s]vice1 t]ms ( use1 g5]al        
release1 us] agreem5t1 or o!r simil>    
docum5t1 ( all in=mation mat]ial to !   
provision ( cons5t4  7ii7 ,hov]+ ov]1   
mut+1 paus+1 or exit+ a giv5 piece (    
cont5t4  7iii7 ,agreem5t obta9$ ?r\gh ! 
use ( a us] int]face design$ or         
manipulat$ ) ! sub/antial effect (      
subv]t+ or impair+ us] autonomy1        
decision mak+1 or *oice4  7#h7 ,heal?   
data ,! t]m heal? data means data t     
id5tifies1 relates to1 describes1 or    
reveals-- 7,a7 ! se>* =1 attempt to     
obta91 or receipt ( any heal? s]vices2  
7,b7 any pa/1 pres5t1 or future         
disability1 physical heal? condition1   
m5tal heal? condition1 or heal?         
condition ( an individual1 includ+ ef=ts
 to rese>* or obta9 heal? s]vices or    
supplies 7includ+ location data t might 

indicate an attempt to acquire or       
receive su* in=mation s]vices or        
supplies72  7,c7 any treatm5t or        
diagnosis ( a disability or condition   
describ$ 9 subp>agraph 7,b72 or  7,d7   
any in=mation describ$ 9 subp>agraph    
7,a7 ?r\gh subp>agraph 7,c7 t is d]iv$  
or extrapolat$ f non-heal? in=mation    
7su* z proxy1 d]ivative1 inf]r$1 em]g5t1
 or algori?mic data74  7#i7 ,location   
data  7,a7 ,9 g5]al ,! t]m location data
 means data d]iv$ f a device or         
te*nology t reveals ! pa/ or pres5t     
physical location ( an individual or    
device ) suffici5t precision to id5tify 
/reet-level location in=mation ( !      
individual or device )9 #a1hej feet or  
less4  7,b7 ,exclusion ,! t]m location  
data does n include geolocation         
in=mation id5tifiable or d]iv$ solely f 
! visual cont5t ( a legally obta9$      
image1 includ+ ! location ( ! device t  
captur$ su* image4  7#aj7 ,s]vice       
provid]  7,a7 ,9 g5]al ,! t]m s]vice    
provid] means an individual or entity   

t--  7i7 collects1 reta9s1 uses1 or     
discloses heal? data = ! sole purpose (1
 & only to ! ext5t t su* individual or  
entity is1 conduct+ bus9ess activities  
on behalf (1 = ! b5efit (1 "u in/ruction
 (1 or "u contractual agreem5t ) a cov]$
 entity & n any o!r individual or       
entity2 &  7ii7 does n divulge heal?    
data to any individual or entity o!r ?an
 su* cov]$ entity or a contractor to su*
 s]vice provid] b\nd to in=mation       
process+ t]ms no less re/rictive ?an    
t]ms to :i* su* s]vice provid] is b\nd4 
7,b7 ,limitation ( application ,su*     
individual or entity %all only be       
consid]$ a s]vice provid] 9 ! c\rse (   
activities describ$ 9 subp>agraph       
7,a77i74  7,c7 ,m9imization by s]vice   
provid]s ,= purposes ( section #b1 a    
reque/ f an individual to a cov]$ entity
 = a product or s]vice1 & an express    
cons5t f ! individual to ! cov]$ entity1
 %all be treat$ z hav+ also be5 provid$ 
to ! s]vice provid] ( ! cov]$ entity4   
7#aa7 ,/ate ,! t]m ,/ate means ea* ( !  

sev]al ,/ates1 ! ,di/rict ( ,columbia1  
ea* commonweal?1 t]ritory1 or possession
 ( ! ,unit$ ,/ates1 & ea* ,f$]ally      
recogniz$ ,indian ,tribe4  7#ab7 ,?ird  
p>ty ,! t]m ?ird p>ty means1 ) respect  
to ! disclos+ or collect+ ( heal? data1 
any individual or entity t is n--  7,a7 
! cov]$ entity t is disclos+ or collect+
 su* in=mation2  7,b7 ! individual to   
:om su* in=mation relates2 or  7,c7 a   
s]vice provid]4  7#ac7 ,ultimate p>5t   
entity ,! t]m ultimate p>5t entity has !
 mean+ giv5 ! t]m 9 section #hja4a (    
title #af1 ,code ( ,f$]al ,regulations  
7or a successor regulation74  7b7       
,rulemak+  7#a7 ,9 g5]al ,n lat] ?an    
#ahj days aft] ! date ( enactm5t ( ?is  
,act1 ! ,commission %all conduct a      
rulemak+ pursuant to section #eec (     
title #e1 ,unit$ ,/ates ,code1 to def9e 
! t]ms public heal? campaign & data =   
purposes ( implem5t+ & en=c+ ?is ,act4  
7#b7 ,requirem5t ,= purposes ( !        
rulemak+ requir$ "u p>agraph 7#a71 ! t]m
 data %all include in=mation t is l9k$1 

or reasonably l9kable1 to--  7,a7       
specific individuals2 or  7,b7 specific 
gr\ps ( individuals :o %>e ! same place 
( resid5ce or int]net protocol address4 
#i4 ,relation%ip to ,f$]al & ,/ate laws 
7a7 ,f$]al law pres]vation ,no?+ 9 ?is  
,act1 or a regulation promulgat$ "u ?is 
,act1 %all be con/ru$ to limit any o!r  
provision ( ,f$]al law1 except z        
specifically provid$ 9 ?is ,act4  7b7   
,/ate law pres]vation  7#a7 ,9 g5]al    
,no?+ 9 ?is ,act1 or a regulation       
promulgat$ "u ?is ,act1 %all be con/ru$ 
to preempt1 displace1 or supplant any   
,/ate law1 except to ! ext5t t a        
provision ( ,/ate law conflicts ) a     
provision ( ?is ,act1 or a regulation   
promulgat$ "u ?is ,act1 & !n only to !  
ext5t ( ! conflict4  7#b7 ,great]       
protection "u ,/ate law ,= purposes (   
?is subsection1 a provision ( ,/ate law 
does n conflict ) a provision ( ?is     
,act1 or a regulation promulgat$ "u ?is 
,act1 if su* provision ( ,/ate law      
provides great] privacy protection ?an !

 privacy protection provid$ by su*      
provision ( ?is ,act or su* regulation4 
#aj4 ,sev]ability clause ,if any        
provision ( ?is ,act1 or ! application  
!re( to any individual1 entity1 or      
circum/ance1 is held invalid1 ! rema9d] 
( ?is ,act1 & ! application ( su*       
provision to o!r p]sons n simil>ly      
situat$ or to o!r circum/ances1 %all n  
be affect$ by ! invalidation4