,,ii  #aai? ,,congress  #a/ ,session    
,s4 #cjig  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,novemb] #d1 #bjbe ,mr4
 ,cassidy introduc$ ! foll[+ bill2 :i* 0
 read twice & ref]r$ to ! ,committee on 
,heal?1 ,education1 ,labor1 & ,p5sions  
,a ,,bill  ,to provide additional       
protections ) respect to heal?          
in=mation1 & = o!r purposes4  #a4  ,%ort
 title  ,?is ,act may be cit$ z ! ,heal?
 ,in=mation ,privacy ,re=m ,act4  #b4   
,protections = applicable heal?         
in=mation  7a7  ,9 g5]al  ,! ,secret>y (
 ,heal? & ,human ,s]vices1 9            
consultation ) ! ,f$]al ,trade          
,commission1 %all promulgate regulations
 sett+ privacy1 security1 & brea*       
notifications /&>ds = ! process+ (      
applicable heal? in=mation by regulat$  
entities & _! s]vice provid]s4 ,su*     
/&>ds %all provide protections t are at 
lea/ comm5surate )1 & :]ev] feasible &  
appropriate h>monize )1 ! protections   
provid$ ?r\gh ! privacy1 security1 &    
brea* notification rules promulgat$ "u  

section #bfd7;c7 ( ! ,heal? ,insurance  
,portability & ,acc\ntability ,act (    
#aiif 7#db ,u4,s4,c4 #acbj;d-#b note7 & 
section #acdjb ( ! ,,hite* ,act 7#db    
,u4,s4,c4 #agicb7 t apply to cov]$      
entities & bus9ess associates ) respect 
to protect$ heal? in=mation "u su*      
rules4 ,su* regulations promulgat$ "u   
?is section %all include ! foll[+3  7#a7
 ,privacy requirem5ts1 includ+ ! foll[+3
  7,a7 ,p]mitt$ uses & disclosures (    
applicable heal? in=mation )\t an       
individual's writt5 au?orization t are  
consi/5t ) ! individual's reasonable    
expectations4  7,b7 ,o!r p]mitt$ uses & 
disclosures ( applicable heal? in=mation
 )\t an individual's writt5 au?orization
 = c]ta9 public policy purposes1 su* z  
public heal?1 heal? ov]sight1 law       
en=cem5t1 judicial & adm9i/rative       
proce$+s1 & any conditions = su* uses & 
disclosures4  7,c7 ,uses & disclosures (
 applicable heal? in=mation t require ! 
individual's writt5 au?orization & !    
requirem5ts relat$ to su* writt5        

au?orizations4  7,d7 ,prohibit$ uses &  
disclosures ( applicable heal?          
in=mation4  7,e7 ,m9imum necess>y       
requirem5ts = ! reque/1 use1 &          
disclosure ( applicable heal? in=mation 
& any exceptions4  7,f7 ,/&>ds &        
requirem5ts relat$ to legal             
repres5tatives ( ! individual4  7,g7    
,/&>ds & requirem5ts relat$ to s]vice   
provid]s4  7,h7 ,individual rights )    
respect to applicable heal? in=mation1  
includ+ ! "r ( ! individual to receive a
 privacy notice f ! regulat$ entity1    
access to applicable heal? in=mation1   
am5dm5t ( applicable heal? in=mation1   
deletion ( applicable heal? in=mation1 &
 portability ( applicable heal?         
in=mation1 & any exceptions to su*      
rights 7su* z ) respect to applicable   
heal? in=mation collect$ = rese>*       
purposes71 any conditions on su* rights1
 & any o!r requirem5ts relat$ to su*    
rights1 includ+ timeframes = respond+ to
 reque/s4  7,i7 ,adm9i/rative safegu>ds1
 includ+ designation ( a privacy (fic]1 

policies & proc$ures1 tra9+ ( work=ce   
memb]s1 non-retaliation1 docum5tation1 &
 mitigation4  7#b7 ,security            
requirem5ts1 includ+ ! foll[+3 7,a7     
,physical1 te*nical1 & adm9i/rative     
safegu>ds = applicable heal? in=mation 9
 any =m4  7,b7 ,= electronic applicable 
heal? in=mation1 su* safegu>ds %all be  
bas$ on well-e/abli%$ national          
frameworks1 su* z cyb]security p]=mance 
goals ( ! ,national ,in/itute ( ,/&>ds &
 ,te*nology or ! ,dep>tm5t ( ,heal? &   
,human ,s]vices4  7#c7 ,brea*           
notification requirem5ts 9 ! ev5t ( a   
brea* ( applicable heal? in=mation t are
 sub/antially simil> to ! brea*         
notification requirem5ts "u subp>t ,d ( 
"p #afd ( title #de1 ,code ( ,f$]al     
,regulations 7or any successor          
regulations74  7b7  ,en=cem5t au?ority  
,! ,secret>y1 9 consultation ) ! ,f$]al 
,trade ,commission1 is au?oriz$ to en=ce
 all provisions ( ?is ,act z describ$ 9 
subsection 7c74  7c7  ,civil p5alties   
,9 addition to any o!r sanctions or     

rem$ies t may be available "u any       
provision ( ,f$]al law1 9 ! case ( a    
regulat$ entity or s]vice provid] t     
violates ?is section1 subp>t ,d ( "p    
#afj ( title #de1 ,code ( ,f$]al        
,regulations 7or any successor          
regulations71 %all apply to ! regulat$  
entity or s]vice provid] ) respect to   
su* violation ( ?is section 9 ! same    
mann] t su* subp>t applies to a p]son ) 
respect to a violation ( "p #afj ( title
 #de1 ,code ( ,f$]al ,regulations 7or   
any successor regulations74  7d7        
,ext5sion ( ,,hite* ,act am5dm5t to     
regulat$ entities & s]vice provid]s  ,! 
privacy & security practices "u section 
#acdab ( ! ,heal? ,in=mation ,te*nology 
= ,economic & ,cl9ical ,heal? ,act 7#db 
,u4,s4,c4 #agida7 %all apply to regulat$
 entities & s]vice provid]s ) respect to
 applicable heal? in=mation 9 ! same    
mann] t su* section applies to cov]$    
entities & bus9ess associates4  7e7     
,def9itions  ,9 ?is section3 7#a7       
,applicable heal? in=mation ,! t]m      

applicable heal? in=mation--  7,a7 means
 in=mation 7includ+ demographic         
in=mation7 t--  7i7 id5tifies an        
individual or ) respect to :i* !re is a 
reasonable basis to believe t !         
in=mation c\ld be us$ to id5tify an     
individual2 &  7ii7 relates to ! pa/1   
pres5t1 or future physical or m5tal     
heal? or condition ( an individual1 !   
provision ( heal? c>e to an individual1 
or ! pa/1 pres5t1 or future paym5t = !  
provision ( heal? c>e to an individual2 
&  7,b7 may include in=mation describ$ 9
 subp>agraph 7,a7 t 0 n creat$ or       
receiv$ by a heal? c>e provid]1 heal?   
plan1 employ]1 or heal? c>e cle>+h\se4  
7#b7  ,cov]$ entities2 bus9ess          
associates  ,! t]ms cov]$ entities &    
bus9ess associates h ! mean+s giv5 su*  
t]ms 9 section #afj4ajc ( title #de1    
,code ( ,f$]al ,regulations 7or any     
successor regulations74  7#c7  ,regulat$
 entity  ,! t]m regulat$ entity-- 7,a7  
means a natural or legal p]son t1 alone 
or jo9tly ) o!rs1 det]m9es ! purpose &  

means ( process+ applicable heal?       
in=mation2 &  7,b7 does n include-- 7i7 
a gov]nm5tal entity su* z a body1       
au?ority1 bo>d1 bureau1 commission1     
di/rict1 ag5cy1 or political subdivision
 ( ! ,f$]al1 ,/ate1 or local gov]nm5t2  
7ii7 a p]son or an entity t is collect+1
 process+1 or transf]r+ cov]$ data on   
behalf ( or a ,f$]al1 ,/ate1 ,tribal1   
t]ritorial1 or local gov]nm5t entity2 & 
7iii7 a cov]$ entity or bus9ess         
associate1 z su* t]ms are def9$ 9       
section #afj4ajc ( title #de1 ,code (   
,f$]al ,regulations 7or any successor   
regulations74  7#d7  ,s]vice provid]  ,!
 t]m s]vice provid] means a natural or  
legal entity t processes applicable     
heal? in=mation on a behalf ( a regulat$
 entity & t is n a cov]$ entity or      
bus9ess associate1 z su* t]ms are def9$ 
9 section #afj4ajc ( title #de1 ,code ( 
,f$]al ,regulations 7or any successor   
regulations74  #c4  ,rights &           
requirem5ts reg>d+ access to c]ta9      
protect$ heal? in=mation  7a7  ,"t &    

mann] ( access  ,9 apply+ section       
#acdje7;e7 ( ! ,heal? ,in=mation        
,te*nology = ,economic & ,cl9ical ,heal?
 ,act 7#db ,u4,s4,c4 #agice7;e77 or     
section #afd4ebd7;c77#c77;ii7 ( title   
#de1 ,code ( ,f$]al ,regulations 7or any
 successor regulations71 9 ! case t an  
individual reque/s t a cov]$ entity or  
any bus9ess associate ( a cov]$ entity  
transmit1 produce1 or provide access to 
a copy ( ! individual's protect$ heal?  
in=mation to a p]son1 includ+ an entity1
 designat$ by ! individual1 & except :]e
 p]mitt$ )\t au?orization "u section    
#afd4ejf7;c7 ( title #de1 ,code ( ,f$]al
 ,regulations 7or any successor         
regulations7--  7#a7 ! individual's     
reque/ %all meet all requirem5ts ( a    
valid au?orization "u section           
#afd4ejh7;b7 ( title #de1 ,code ( ,f$]al
 ,regulations 7or any successor         
regulations72 &  7#b7 ! cov]$ entity or 
bus9ess associate may condition !       
transmittal1 production1 or provision ( 
access ^u ! p]son to :om ! in=mation is 

to be transmitt$ or produc$ or to :om   
access is to be provid$--  7,a7 pay+    
fees1 9 accordance ) applicable ,/ate   
law & consi/5t ) subsection 7b71 9      
advance ( su* transmittal1 production1  
or access2 &  7,b7 ackn[l$g+ & accept+ !
 t]ms1 limitations1 & conditions ( use &
 disclosure conta9$ 9 ! reque/ made by !
 individual z ! legally b9d+ obligation 
( ! p]son receiv+ ! in=mation4  7b7     
,fees  7#a7  ,9 g5]al  ,9 apply+ section
 #acdje7;e77#c7 ( ! ,heal? ,in=mation   
,te*nology = ,economic & ,cl9ical ,heal?
 ,act 7#db ,u4,s4,c4 #agice7;e77#c77 or 
section #afd4ebd7;c77#d7 ( title #de1   
,code ( ,f$]al ,regulations 7or any     
successor regulations71 ea* su* section 
%all apply only--  7,a7 to ! provision (
 access to1 or ! production1 copy+1 or  
transmittal (1 protect$ heal? in=mation 
directly to--  7i7 ! individual1 or !   
individual's p]sonal repres5tative =    
heal? c>e purposes z describ$ 9 section 
#afd4ejb7;g7 ( title #de1 ,code ( ,f$]al
 ,regulations 7or any successor         

regulations72  7ii7 subject to p>agraph 
7#b7 & section #afd4eaj7;b7 ( title #de1
 ,code ( ,f$]al ,regulations 7or any    
successor regulation71 any o!r p]son    
id5tifi$ 91 & subject to ! limitations  
(1 su* section2 or  7iii7 ! individual's
 heal? c>e provid] or ! bus9ess         
associates ( su* provid]2 &  7,b7 z     
direct$ by ! individual1 to ! electronic
 transmittal ( ! individual's electronic
 heal? record to ! pati5t portal or     
mobile m$ical application us$ & ma9ta9$ 
by ! individual's heal? c>e provid] or =
 ! heal? c>e provid] by its bus9ess     
associate4  7#b7  ,additional           
limitations  ,9 ! case ( ! provision (  
access to1 or ! production1 copy+1 or   
transmittal (1 protect$ heal? in=mation 
"u p>agraph 7#a77;,a7 directly to a     
p]son describ$ 9 clause 7ii7 ( su*      
p>agraph1 su* protect$ heal? in=mation  
%all1 9 accordance ) section            
#afd4eaj7;b7 ( title #de1 ,code ( ,f$]al
 ,regulations 7or any successor         
regulations71 be limit$ to only su*     

in=mation t is--  7,a7 directly relevant
 to ! p]son's involvem5t ) ! c>e ( !    
individual or ) ! paym5t relevant to !  
c>e ( ! individual2 or  7,b7 ne$$ =     
notification purposes describ$ 9 su*    
section4  7c7 ,def9itions ,9 ?is        
section1 ! t]ms bus9ess associate1 cov]$
 entity1 heal? c>e provid]1 individual1 
p]son1 & protect$ heal? in=mation h !   
mean+s giv5 su* t]ms 9 section #afj4ajc 
( title #de1 ,code ( ,f$]al ,regulations
 7or any successor regulations74  7d7   
,guidance  ,n lat] ?an #ahj days aft] ! 
date ( enactm5t ( ?is ,act1 ! ,secret>y 
( ,heal? & ,human ,s]vices %all am5d    
exi/+ guidance z necess>y to implem5t   
subsections 7a7 & 7b74  #d4             
,confid5tiality ( records  ,section #edc
 ( ! ,public ,heal? ,s]vice ,act 7#db   
,u4,s4,c4 #bij;dd-#b7 is am5d$--  7#a7 9
 subsection 7a71 by /rik+ subsection 7b7
 & ins]t+ ! ,,hipaa regulations2  7#b7 9
 subsection 7b7-- 7,a7 9 p>agraph 7#b71 
by r$esignat+ subp>agraphs 7,a7 ?r\gh   
7,d7 z p>agraphs 7#a7 ?r\gh 7#d71       

respectively1 & adju/+ ! m>g9s          
accord+ly2 &  7,b7 by /rik+ 7b7 ,p]mitt$
 disclosure & all t foll[s ?r\gh 7#b7   
,me?od = disclosure--,:e!r & ins]t+ !   
foll[+3  7b7  ,p]mitt$ disclosure  ,:e!r
  2  7#c7 9 subsection 7c71 9 ! matt]   
prec$+ p>agraph 7#a71 by /rik+          
subsection 7b77#b77;,c7 & ins]t+        
subsection 7b77#c72 &  7#d7 9 subsection
 7g71 by /rik+ subsection 7b77#b77;,c7 &
 ins]t+ subsection 7b77#c74  #e4  ,,nas 
/udy on comp5sation to pati5ts = %>+    
id5tifiable data = rese>* purposes  7a7 
,9 g5]al  ,n lat] ?an #fj days aft] !   
date ( enactm5t ( ?is ,act1 ! ,secret>y 
( ,heal? & ,human ,s]vices %all seek to 
ent] into a contract ) ! ,national      
,academies ( ,sci5ces1 ,eng9e]+1 &      
,m$ic9e to conduct a /udy exam9+        
pot5tial risks & b5efits ( pay+         
comp5sation to pati5ts = %>+ _!         
id5tifiable data = rese>* purposes4  7b7
  ,inclusions  ,! /udy conduct$ pursuant
 to ! contract "u subsection 7a7 %all   
include an exam9ation (--  7#a7 ! risks 

to pati5t privacy pos$ by ! integration 
( id5tifiable1 de-id5tifi$1 & aggregat$ 
heal? in=mation into datasets us$ =     
rese>*2  7#b7 privacy enhanc+ tools &   
me?ods = ! protection ( pati5t heal?    
data2  7#c7 ! feasibility ( track+      
pati5t data & cons5t = ! integration (  
pati5t heal? data into datasets us$ =   
rese>*2  7#d7 e?ical consid]ations =    
comp5sat+ pati5ts = use ( _! id5tifiable
 & de-id5tifi$ heal? data2  7#e7 :e!r ! 
exi/+ exemptions p]mitt+ de-id5tifi$    
data to be us$ = rese>* %\ld consid]    
:e!r a pati5t 0 giv5 an opportunity to  
opt-9 or opt-out ( p>ticipation2 &  7#f7
 risk ( re-id5tification ( de-id5tifi$  
data4  #f4 ,pati5t notification         
requirem5ts "u ! ,,hipaa privacy        
regulations  7a7 ,pati5t notification ^u
 removal ,any regulat$ entity or s]vice 
provid] :o ga9s access to ! protect$    
heal? in=mation ( an individual ?r\gh ! 
pati5t "r ( access "u section #afd4ebd (
 title #de1 ,code ( ,f$]al ,regulations 
7or any successor regulations7 %all--   

7#a7 provide a writt5 pla9 language     
notification to su* individual prior to 
access+ su* in=mation--  7,a7 t su*     
protect$ heal? in=mation w no long] be  
subject to ! protections "u ! ,,hipaa   
privacy regulation2 &  7,b7 t includes  
an explanation ( h[ & to :i* entities   
su* protect$ heal? in=mation may be     
r$isclos$2 &  7#b7 require ! cons5t ( ! 
individual be=e sell+ su* protect$ heal?
 in=mation to ?ird p>ties4  7b7  ,pati5t
 notification reg>d+ wellness data  7#a7
  ,9 g5]al  ,any regulat$ entity or     
s]vice provid] :o (f]s digital te*nology
 t g5]ates wellness data ab\t           
individuals %all1 ) respect to ea*      
individual :o uses su* te*nology--  7,a7
 provide a writt5 pla9 language         
notification to ! individual 9 advance (
 initiat+ ! g5]ation ( su* data t su*   
data w n be subject to ! protections ( !
 ,,hipaa privacy regulation2 &  7,b7 (f]
 ! individual an opportunity to opt out 
( su* wellness data g5]ation4  7#b7     
,wellness data  ,9 ?is subsection1 ! t]m

 wellness data means data g5]at$ = !    
purpose ( promot+ heal? or prev5t+      
disease1 :i* may include vital /ati/ics1
 /ep c\nts1 & m$ical regim5 compliance4 
7c7  ,def9itions  ,9 ?is section-- 7#a7 
! t]ms bus9ess associate1 cov]$ entity1 
& protect$ heal? in=mation h ! mean+s   
giv5 su* t]ms 9 section #afj4ajc ( title
 #de1 ,code ( ,f$]al ,regulations 7or   
any successor regulations72  7#b7 ! t]m 
,,hipaa privacy regulation has ! mean+  
giv5 su* t]m 9 section #aahj7;b77#c7 ( !
 ,social ,security ,act 7#db ,u4,s4,c4  
#acbj;d-#i7;b77#c772 &  7#c7 ! t]ms     
regulat$ entity & s]vice provid] h !    
mean+s giv5 su* t]ms 9 section #b4  7d7 
,effective date  ,?is section %all take 
effect beg9n+ "o ye> aft] ! date (      
enactm5t ( ?is ,act4  #g4  ,m9imum      
necess>y guidance  ,n lat] ?an #a ye>   
aft] ! date ( enactm5t ( ?is ,act1 !    
,secret>y ( ,heal? & ,human ,s]vices    
%all publi% guidance on ! application ( 
! m9imum necess>y /&>d to data us$ =    
artificial intellig5ce & o!r ma*9e le>n+

 applications & relevant requirem5ts1   
includ+ heal? data int]op]ability       
requirem5ts "u section #cjja7;c77#i7 ( !
 ,public ,heal? ,s]vice ,act 7#db       
,u4,s4,c4 #cjj;jj-#aa7;c77#i77 & ! use (
 limit$ data sets pursuant to section   
#acdje7;b7 ( ! ,,hite* ,act 7#db        
,u4,s4,c4 #agice7;b774  #h4             
,de-id5tifi$ in=mation  7a7  ,e/abli%m5t
 ( /&>ds  ,n lat] ?an #a ye> aft] ! date
 ( enactm5t ( ?is ,act1 ! ,secret>y (   
,heal? & ,human ,s]vices %all promulgate
 regulations e/abli%+ unifi$ national   
/&>ds = r5d]+ applicable heal? in=mation
 z de-id5tifi$ in=mation1 9 a mann]     
simil> to ! mann] 9 :i* individually    
id5tifiable heal? in=mation may be r5d]$
 de-id5tifi$ in=mation pursuant to "p   
#afd ( title #de1 ,code ( ,f$]al        
,regulations 7or any successor          
regulations74  7b7  ,composition ( /&>ds
  ,su* /&>ds %all-- 7#a7 be at lea/     
equival5t to or exce$ ! de-id5tification
 /&>d specifi$ 9 section #afd4ead7;b7 ( 
title #de1 ,code ( ,f$]al ,regulations  

7or any successor regulations72  7#b7   
specify /&>ds = ! use ( privacy-enhanc+ 
te*nologies z a me?od = creat+          
de-id5tifi$ in=mation2 &  7#c7 specify t
 in=mation %all n qualify z de-id5tifi$ 
in=mation :5 provid$ by a regulat$      
entity1 s]vice provid]1 cov]$ entity1 or
 bus9ess associate to ano!r p]son or    
entity unless su* p]son or entity       
contractually agrees 9 writ+ n to       
re-id5tify or attempt to re-id5tify !   
in=mation1 & to require ! same ( any    
p]son or entity to :om su* p]son or     
entity provides ! in=mation4  7c7       
,def9itions  ,9 ?is section-- 7#a7 ! t]m
 applicable heal? in=mation has ! mean+ 
giv5 su* t]m 9 section #b2  7#b7 ! t]ms 
bus9ess associate1 cov]$ entity1 &      
individually id5tifiable heal? in=mation
 h ! mean+s giv5 su* t]ms 9 section     
#afj4ajc ( title #de1 ,code ( ,f$]al    
,regulations 7or any successor          
regulations72 &  7#c7 ! t]m privacy     
enhanc+ te*nologies means any s(tw>e or 
h>dw>e solution1 te*nical process1 or   

o!r te*nological means ( mitigat+       
individuals' privacy risks aris+ f data 
process+ by enhanc+ pr$ictability1      
manageability1 disassociability1 &      
confid5tiality4  #i4  ,preemption       
,section #afj4bjc ( title #de1 ,code (  
,f$]al ,regulations 7or any successor   
regulations7 %all apply to ! requirem5ts
 set =? "u ?is ,act 9 ! same mann] & to 
! same ext5t z su* section applies to ! 
/&>ds1 requirem5ts1 & implem5tation     
specifications "u sub*apt] ,c ( *apt] ,i
 ( subtitle ,a ( title #de1 ,code (     
,f$]al ,regulations 7or any successor   
regulations74