,i  #aaith ,,congress  #ast ,session    
,h4 ,r4 #bcfc  ,,in ,,the ,,house ,,of  
,,representatives  ,march #bf1 #bjbe,ms4
 ,de,gette 7for herself1 ,mr4 ,goldman  
of ,new ,york1 ,mr4 ,carter of          
,louisiana1 ,ms4 ,pressley1 and ,ms4    
,snchez7 introduced the following bill2 
which was referred to the ,committee on 
,energy and ,commerce  ,a ,,bill  ,to   
prohibit the authorization of certain   
individuals to access certain systems   
containing individually identifiable    
health information4  #a4 ,short title   
,this ,act may be cited as the ,data ,of
 ,government health ,entities must be   
,protected from ,overreach by ,unelected
 ,nonsecure ,disruption ,act of #bjbe or
 the ,,doge ,,pound ,act of #bjbe4  #b4 
,prohibiting the authorization of       
certain individuals to access certain   
systems containing individually         
identifiable health information  7a7 ,in
 general ,notwithstanding any other     
provision of law1 no individual may be  
authorized to use1 exercise             

administrative control over1 or         
otherwise access any specified system   
7as defined in subsection 7d771 or any  
data from any such system1 unless-- 7#a7
 such individual is an officer1         
employee1 or contractor of the          
,department of ,health and ,human       
,services who-- 7,a7 was otherwise      
eligible to access such system or data  
prior to ,january #bj1 #bjbe2 and  7,b7 
continued to be otherwise eligible to   
access such system or data between      
,january #bj1 #bjbe1 and the date of    
access to such system or data2 or  7#b7 
in the case of an individual not        
described in paragraph 7#a7-- 7,a7 such 
individual holds a security clearance at
 the appropriate level with respect to  
such system or data and such clearance  
was granted pursuant to the procedures  
established under section #hja of the   
,national ,security ,act of #aidg 7#ej  
,u4,s4,c4 #cafa72  7,b7 such            
individual's access to such system or   
data1 or use thereof1 does not          

constitute a violation of section #bjh  
of title #ah1 ,united ,states ,code     
7determined after the application of    
subsection 7b772  7,c7 such individual  
is not a special ,government employee   
7as defined in section #bjb of title    
#ah1 ,united ,states ,code72  7,d7 such 
individual's current continuous service 
in the civil service 7as that term is   
defined in section #baja of title #e1   
,united ,states ,code7 as of the date of
 such access is for a period of at least
 #a year2  7,e7 such individual has     
completed any required training or      
compliance procedures with respect to   
privacy laws and cybersecurity and      
national security regulations and best  
practices2 and  7,f7 such individual has
 signed a written ethics agreement with 
either the ,department of ,health and   
,human ,services or the ,office of      
,government ,ethics4  7b7 ,application  
of penalties  7#a7 ,in general ,whoever 
knowingly-- 7,a7 uses1 exercises        
administrative control over1 or         

otherwise accesses any system or data   
described in subsection 7a7 in violation
 of such subsection1 or  7,b7 authorizes
 the use1 exercise of administrative    
control over1 or other access to any    
system or data described in subsection  
7a7 in violation of such subsection1    
shall be imprisoned not more than #e    
years or fined under title #ah1 ,united 
,states ,code1 or both4  7#b7 ,statute  
of limitations ,notwithstanding section 
#cbhb of title #ah1 ,united ,states     
,code1 no person shall be prosecuted1   
tried1 or punished for any offense under
 this subsection unless the indictment  
is found or the information is          
instituted not later than #aj years     
after the date on which the offense was 
committed4  7c7 ,reports on unauthorized
 use ,the ,inspector ,general of the    
,department of ,health and ,human       
,services shall investigate1 and submit 
a report to ,congress on such           
investigation1 each instance of         
unauthorized use or other access of any 

specified system4 ,any such report shall
 be submitted not later than #cj days   
after any such instance and shall       
include-- 7#a7 a detailed description of
 the unauthorized use or access1        
including any actions the individual    
carried out2  7#b7 a risk assessment of 
any threat to privacy1 national         
security1 cybersecurity1 or the         
integrity of the applicable system as a 
result of such unauthorized use or      
access2 and  7#c7 a detailed description
 of any stopped payments during the     
unauthorized use or access4  7d7        
,specified system ,for purposes of this 
section1 the term specified system means
 any system maintained by the           
,department of ,health and ,human       
,services that contains individually    
identifiable health information 7as     
defined in section #aaga7f7 of the      
,social ,security ,act 7#db ,u4,s4,c4   
#acbj;d7#f7774