,,ii  #aaith ,,congress  #ast ,session  
,s4 #cjig  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,november #d1  
#bjbe ,mr4 ,cassidy introduced the      
following bill2 which was read twice and
 referred to the ,committee on ,health1 
,education1 ,labor1 and ,pensions  ,a   
,,bill  ,to provide additional          
protections with respect to health      
information1 and for other purposes4    
#a4  ,short title  ,this ,act may be    
cited as the ,health ,information       
,privacy ,reform ,act4  #b4             
,protections for applicable health      
information  7a7  ,in general  ,the     
,secretary of ,health and ,human        
,services1 in consultation with the     
,federal ,trade ,commission1 shall      
promulgate regulations setting privacy1 
security1 and breach notifications      
standards for the processing of         
applicable health information by        
regulated entities and their service    
providers4 ,such standards shall provide
 protections that are at least          

commensurate with1 and wherever feasible
 and appropriate harmonize with1 the    
protections provided through the        
privacy1 security1 and breach           
notification rules promulgated under    
section #bfd7;c7 of the ,health         
,insurance ,portability and             
,accountability ,act of #aiif 7#db      
,u4,s4,c4 #acbj;d-#b note7 and section  
#acdjb of the ,,hitech ,act 7#db        
,u4,s4,c4 #agicb7 that apply to covered 
entities and business associates with   
respect to protected health information 
under such rules4 ,such regulations     
promulgated under this section shall    
include the following3  7#a7 ,privacy   
requirements1 including the following3  
7,a7 ,permitted uses and disclosures of 
applicable health information without an
 individual's written authorization that
 are consistent with the individual's   
reasonable expectations4  7,b7 ,other   
permitted uses and disclosures of       
applicable health information without an
 individual's written authorization for 

certain public policy purposes1 such as 
public health1 health oversight1 law    
enforcement1 judicial and administrative
 proceedings1 and any conditions for    
such uses and disclosures4  7,c7 ,uses  
and disclosures of applicable health    
information that require the            
individual's written authorization and  
the requirements related to such written
 authorizations4  7,d7 ,prohibited uses 
and disclosures of applicable health    
information4  7,e7 ,minimum necessary   
requirements for the request1 use1 and  
disclosure of applicable health         
information and any exceptions4  7,f7   
,standards and requirements related to  
legal representatives of the individual4
  7,g7 ,standards and requirements      
related to service providers4  7,h7     
,individual rights with respect to      
applicable health information1 including
 the right of the individual to receive 
a privacy notice from the regulated     
entity1 access to applicable health     
information1 amendment of applicable    

health information1 deletion of         
applicable health information1 and      
portability of applicable health        
information1 and any exceptions to such 
rights 7such as with respect to         
applicable health information collected 
for research purposes71 any conditions  
on such rights1 and any other           
requirements related to such rights1    
including timeframes for responding to  
requests4  7,i7 ,administrative         
safeguards1 including designation of a  
privacy officer1 policies and           
procedures1 training of workforce       
members1 non-retaliation1 documentation1
 and mitigation4  7#b7 ,security        
requirements1 including the following3  
7,a7 ,physical1 technical1 and          
administrative safeguards for applicable
 health information in any form4  7,b7  
,for electronic applicable health       
information1 such safeguards shall be   
based on well-established national      
frameworks1 such as cybersecurity       
performance goals of the ,national      

,institute of ,standards and ,technology
 or the ,department of ,health and      
,human ,services4  7#c7 ,breach         
notification requirements in the event  
of a breach of applicable health        
information that are substantially      
similar to the breach notification      
requirements under subpart ,d of part   
#afd of title #de1 ,code of ,federal    
,regulations 7or any successor          
regulations74  7b7  ,enforcement        
authority  ,the ,secretary1 in          
consultation with the ,federal ,trade   
,commission1 is authorized to enforce   
all provisions of this ,act as described
 in subsection 7c74  7c7  ,civil        
penalties  ,in addition to any other    
sanctions or remedies that may be       
available under any provision of        
,federal law1 in the case of a regulated
 entity or service provider that        
violates this section1 subpart ,d of    
part #afj of title #de1 ,code of        
,federal ,regulations 7or any successor 
regulations71 shall apply to the        

regulated entity or service provider    
with respect to such violation of this  
section in the same manner that such    
subpart applies to a person with respect
 to a violation of part #afj of title   
#de1 ,code of ,federal ,regulations 7or 
any successor regulations74  7d7        
,extension of ,,hitech ,act amendment to
 regulated entities and service         
providers  ,the privacy and security    
practices under section #acdab of the   
,health ,information ,technology for    
,economic and ,clinical ,health ,act    
7#db ,u4,s4,c4 #agida7 shall apply to   
regulated entities and service providers
 with respect to applicable health      
information in the same manner that such
 section applies to covered entities and
 business associates4  7e7  ,definitions
  ,in this section3 7#a7 ,applicable    
health information ,the term applicable 
health information--  7,a7 means        
information 7including demographic      
information7 that--  7i7 identifies an  
individual or with respect to which     

there is a reasonable basis to believe  
that the information could be used to   
identify an individual2 and  7ii7       
relates to the past1 present1 or future 
physical or mental health or condition  
of an individual1 the provision of      
health care to an individual1 or the    
past1 present1 or future payment for the
 provision of health care to an         
individual2 and  7,b7 may include       
information described in subparagraph   
7,a7 that was not created or received by
 a health care provider1 health plan1   
employer1 or health care clearinghouse4 
7#b7  ,covered entities2 business       
associates  ,the terms covered entities 
and business associates have the        
meanings given such terms in section    
#afj4ajc of title #de1 ,code of ,federal
 ,regulations 7or any successor         
regulations74  7#c7  ,regulated entity  
,the term regulated entity-- 7,a7 means 
a natural or legal person that1 alone or
 jointly with others1 determines the    
purpose and means of processing         

applicable health information2 and  7,b7
 does not include-- 7i7 a governmental  
entity such as a body1 authority1 board1
 bureau1 commission1 district1 agency1  
or political subdivision of the         
,federal1 ,state1 or local government2  
7ii7 a person or an entity that is      
collecting1 processing1 or transferring 
covered data on behalf of or a ,federal1
 ,state1 ,tribal1 territorial1 or local 
government entity2 and  7iii7 a covered 
entity or business associate1 as such   
terms are defined in section #afj4ajc of
 title #de1 ,code of ,federal           
,regulations 7or any successor          
regulations74  7#d7  ,service provider  
,the term service provider means a      
natural or legal entity that processes  
applicable health information on a      
behalf of a regulated entity and that is
 not a covered entity or business       
associate1 as such terms are defined in 
section #afj4ajc of title #de1 ,code of 
,federal ,regulations 7or any successor 
regulations74  #c4  ,rights and         

requirements regarding access to certain
 protected health information  7a7      
,time and manner of access  ,in applying
 section #acdje7;e7 of the ,health      
,information ,technology for ,economic  
and ,clinical ,health ,act 7#db         
,u4,s4,c4 #agice7;e77 or section        
#afd4ebd7;c77#c77;ii7 of title #de1     
,code of ,federal ,regulations 7or any  
successor regulations71 in the case that
 an individual requests that a covered  
entity or any business associate of a   
covered entity transmit1 produce1 or    
provide access to a copy of the         
individual's protected health           
information to a person1 including an   
entity1 designated by the individual1   
and except where permitted without      
authorization under section #afd4ejf7;c7
 of title #de1 ,code of ,federal        
,regulations 7or any successor          
regulations7--  7#a7 the individual's   
request shall meet all requirements of a
 valid authorization under section      
#afd4ejh7;b7 of title #de1 ,code of     

,federal ,regulations 7or any successor 
regulations72 and  7#b7 the covered     
entity or business associate may        
condition the transmittal1 production1  
or provision of access upon the person  
to whom the information is to be        
transmitted or produced or to whom      
access is to be provided--  7,a7 paying 
fees1 in accordance with applicable     
,state law and consistent with          
subsection 7b71 in advance of such      
transmittal1 production1 or access2 and 
7,b7 acknowledging and accepting the    
terms1 limitations1 and conditions of   
use and disclosure contained in the     
request made by the individual as the   
legally binding obligation of the person
 receiving the information4  7b7  ,fees 
7#a7  ,in general  ,in applying section 
#acdje7;e77#c7 of the ,health           
,information ,technology for ,economic  
and ,clinical ,health ,act 7#db         
,u4,s4,c4 #agice7;e77#c77 or section    
#afd4ebd7;c77#d7 of title #de1 ,code of 
,federal ,regulations 7or any successor 

regulations71 each such section shall   
apply only--  7,a7 to the provision of  
access to1 or the production1 copying1  
or transmittal of1 protected health     
information directly to--  7i7 the      
individual1 or the individual's personal
 representative for health care purposes
 as described in section #afd4ejb7;g7 of
 title #de1 ,code of ,federal           
,regulations 7or any successor          
regulations72  7ii7 subject to paragraph
 7#b7 and section #afd4eaj7;b7 of title 
#de1 ,code of ,federal ,regulations 7or 
any successor regulation71 any other    
person identified in1 and subject to the
 limitations of1 such section2 or  7iii7
 the individual's health care provider  
or the business associates of such      
provider2 and  7,b7 as directed by the  
individual1 to the electronic           
transmittal of the individual's         
electronic health record to the patient 
portal or mobile medical application    
used and maintained by the individual's 
health care provider or for the health  

care provider by its business associate4
  7#b7  ,additional limitations  ,in the
 case of the provision of access to1 or 
the production1 copying1 or transmittal 
of1 protected health information under  
paragraph 7#a77;,a7 directly to a person
 described in clause 7ii7 of such       
paragraph1 such protected health        
information shall1 in accordance with   
section #afd4eaj7;b7 of title #de1 ,code
 of ,federal ,regulations 7or any       
successor regulations71 be limited to   
only such information that is--  7,a7   
directly relevant to the person's       
involvement with the care of the        
individual or with the payment relevant 
to the care of the individual2 or  7,b7 
needed for notification purposes        
described in such section4  7c7         
,definitions ,in this section1 the terms
 business associate1 covered entity1    
health care provider1 individual1       
person1 and protected health information
 have the meanings given such terms in  
section #afj4ajc of title #de1 ,code of 

,federal ,regulations 7or any successor 
regulations74  7d7  ,guidance  ,not     
later than #ahj days after the date of  
enactment of this ,act1 the ,secretary  
of ,health and ,human ,services shall   
amend existing guidance as necessary to 
implement subsections 7a7 and 7b74  #d4 
,confidentiality of records  ,section   
#edc of the ,public ,health ,service    
,act 7#db ,u4,s4,c4 #bij;dd-#b7 is      
amended--  7#a7 in subsection 7a71 by   
striking subsection 7b7 and inserting   
the ,,hipaa regulations2  7#b7 in       
subsection 7b7-- 7,a7 in paragraph 7#b71
 by redesignating subparagraphs 7,a7    
through 7,d7 as paragraphs 7#a7 through 
7#d71 respectively1 and adjusting the   
margins accordingly2 and  7,b7 by       
striking 7b7 ,permitted disclosure and  
all that follows through 7#b7 ,method   
for disclosure--,whether and inserting  
the following3  7b7  ,permitted         
disclosure  ,whether  2  7#c7 in        
subsection 7c71 in the matter preceding 
paragraph 7#a71 by striking subsection  

7b77#b77;,c7 and inserting subsection   
7b77#c72 and  7#d7 in subsection 7g71 by
 striking subsection 7b77#b77;,c7 and   
inserting subsection 7b77#c74  #e4      
,,nas study on compensation to patients 
for sharing identifiable data for       
research purposes  7a7  ,in general     
,not later than #fj days after the date 
of enactment of this ,act1 the          
,secretary of ,health and ,human        
,services shall seek to enter into a    
contract with the ,national ,academies  
of ,sciences1 ,engineering1 and         
,medicine to conduct a study examining  
potential risks and benefits of paying  
compensation to patients for sharing    
their identifiable data for research    
purposes4  7b7  ,inclusions  ,the study 
conducted pursuant to the contract under
 subsection 7a7 shall include an        
examination of--  7#a7 the risks to     
patient privacy posed by the integration
 of identifiable1 de-identified1 and    
aggregated health information into      
datasets used for research2  7#b7       

privacy enhancing tools and methods for 
the protection of patient health data2  
7#c7 the feasibility of tracking patient
 data and consent for the integration of
 patient health data into datasets used 
for research2  7#d7 ethical             
considerations for compensating patients
 for use of their identifiable and      
de-identified health data2  7#e7 whether
 the existing exemptions permitting     
de-identified data to be used for       
research should consider whether a      
patient was given an opportunity to     
opt-in or opt-out of participation2 and 
7#f7 risk of re-identification of       
de-identified data4  #f4 ,patient       
notification requirements under the     
,,hipaa privacy regulations  7a7        
,patient notification upon removal ,any 
regulated entity or service provider who
 gains access to the protected health   
information of an individual through the
 patient right of access under section  
#afd4ebd of title #de1 ,code of ,federal
 ,regulations 7or any successor         

regulations7 shall--  7#a7 provide a    
written plain language notification to  
such individual prior to accessing such 
information--  7,a7 that such protected 
health information will no longer be    
subject to the protections under the    
,,hipaa privacy regulation2 and  7,b7   
that includes an explanation of how and 
to which entities such protected health 
information may be redisclosed2 and     
7#b7 require the consent of the         
individual before selling such protected
 health information to third parties4   
7b7  ,patient notification regarding    
wellness data  7#a7  ,in general  ,any  
regulated entity or service provider who
 offers digital technology that         
generates wellness data about           
individuals shall1 with respect to each 
individual who uses such technology--   
7,a7 provide a written plain language   
notification to the individual in       
advance of initiating the generation of 
such data that such data will not be    
subject to the protections of the       

,,hipaa privacy regulation2 and  7,b7   
offer the individual an opportunity to  
opt out of such wellness data           
generation4  7#b7  ,wellness data  ,in  
this subsection1 the term wellness data 
means data generated for the purpose of 
promoting health or preventing disease1 
which may include vital statistics1 step
 counts1 and medical regimen compliance4
  7c7  ,definitions  ,in this section-- 
7#a7 the terms business associate1      
covered entity1 and protected health    
information have the meanings given such
 terms in section #afj4ajc of title #de1
 ,code of ,federal ,regulations 7or any 
successor regulations72  7#b7 the term  
,,hipaa privacy regulation has the      
meaning given such term in section      
#aahj7;b77#c7 of the ,social ,security  
,act 7#db ,u4,s4,c4 #acbj;d-#i7;b77#c772
 and  7#c7 the terms regulated entity   
and service provider have the meanings  
given such terms in section #b4  7d7    
,effective date  ,this section shall    
take effect beginning one year after the

 date of enactment of this ,act4  #g4   
,minimum necessary guidance  ,not later 
than #a year after the date of enactment
 of this ,act1 the ,secretary of ,health
 and ,human ,services shall publish     
guidance on the application of the      
minimum necessary standard to data used 
for artificial intelligence and other   
machine learning applications and       
relevant requirements1 including health 
data interoperability requirements under
 section #cjja7;c77#i7 of the ,public   
,health ,service ,act 7#db ,u4,s4,c4    
#cjj;jj-#aa7;c77#i77 and the use of     
limited data sets pursuant to section   
#acdje7;b7 of the ,,hitech ,act 7#db    
,u4,s4,c4 #agice7;b774  #h4             
,de-identified information  7a7         
,establishment of standards  ,not later 
than #a year after the date of enactment
 of this ,act1 the ,secretary of ,health
 and ,human ,services shall promulgate  
regulations establishing unified        
national standards for rendering        
applicable health information as        

de-identified information1 in a manner  
similar to the manner in which          
individually identifiable health        
information may be rendered             
de-identified information pursuant to   
part #afd of title #de1 ,code of        
,federal ,regulations 7or any successor 
regulations74  7b7  ,composition of     
standards  ,such standards shall-- 7#a7 
be at least equivalent to or exceed the 
de-identification standard specified in 
section #afd4ead7;b7 of title #de1 ,code
 of ,federal ,regulations 7or any       
successor regulations72  7#b7 specify   
standards for the use of                
privacy-enhancing technologies as a     
method for creating de-identified       
information2 and  7#c7 specify that     
information shall not qualify as        
de-identified information when provided 
by a regulated entity1 service provider1
 covered entity1 or business associate  
to another person or entity unless such 
person or entity contractually agrees in
 writing not to re-identify or attempt  

to re-identify the information1 and to  
require the same of any person or entity
 to whom such person or entity provides 
the information4  7c7  ,definitions  ,in
 this section-- 7#a7 the term applicable
 health information has the meaning     
given such term in section #b2  7#b7 the
 terms business associate1 covered      
entity1 and individually identifiable   
health information have the meanings    
given such terms in section #afj4ajc of 
title #de1 ,code of ,federal            
,regulations 7or any successor          
regulations72 and  7#c7 the term privacy
 enhancing technologies means any       
software or hardware solution1 technical
 process1 or other technological means  
of mitigating individuals' privacy risks
 arising from data processing by        
enhancing predictability1 manageability1
 disassociability1 and confidentiality4 
#i4  ,preemption  ,section #afj4bjc of  
title #de1 ,code of ,federal            
,regulations 7or any successor          
regulations7 shall apply to the         

requirements set forth under this ,act  
in the same manner and to the same      
extent as such section applies to the   
standards1 requirements1 and            
implementation specifications under     
subchapter ,c of chapter ,i of subtitle 
,a of title #de1 ,code of ,federal      
,regulations 7or any successor          
regulations74