,,ii ,cal5d> ,no4 #ech #aai? ,,congress #b;d ,session ,s4 #cjig ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,novemb] #d1 #bjbe,mr4 ,cassidy introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions ,augu/ #d1 #bjbf,report$ by ,mr4 ,cassidy1 ) an amendment,strike out all aft] ! enact+ clause & ins]t ! "p pr9t$ 9 italic ,a ,,bill ,to provide additional protections ) respect to heal? in=mation1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,heal? ,in=mation ,privacy ,re=m ,act4 #b4 ,protections = applicable heal? in=mation 7a7 ,9 g5]al ,! ,secret>y ( ,heal? & ,human ,s]vices1 9 consultation ) ! ,f$]al ,trade ,commission1 %all promulgate regulations sett+ privacy1 security1 & brea* notifications /&>ds = ! process+ ( applicable heal? in=mation by regulat$ entities & _! s]vice provid]s4 ,su* /&>ds %all provide protections t are at lea/ comm5surate )1 & :]ev] feasible & appropriate h>monize )1 ! protections provid$ ?r\gh ! privacy1 security1 & brea* notification rules promulgat$ "u section #bfd7;c7 ( ! ,heal? ,insurance ,portability & ,acc\ntability ,act ( #aiif 7#db ,u4,s4,c4 #acbj;d-#b note7 & section #acdjb ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agicb7 t apply to cov]$ entities & bus9ess associates ) respect to protect$ heal? in=mation "u su* rules4 ,su* regulations promulgat$ "u ?is section %all include ! foll[+3 7#a7 ,privacy requirem5ts1 includ+ ! foll[+3 7,a7 ,p]mitt$ uses & disclosures ( applicable heal? in=mation )\t an individual's writt5 au?orization t are consi/5t ) ! individual's reasonable expectations4 7,b7 ,o!r p]mitt$ uses & disclosures ( applicable heal? in=mation )\t an individual's writt5 au?orization = c]ta9 public policy purposes1 su* z public heal?1 heal? ov]sight1 law en=cem5t1 judicial & adm9i/rative proce$+s1 & any conditions = su* uses & disclosures4 7,c7 ,uses & disclosures ( applicable heal? in=mation t require ! individual's writt5 au?orization & ! requirem5ts relat$ to su* writt5 au?orizations4 7,d7 ,prohibit$ uses & disclosures ( applicable heal? in=mation4 7,e7 ,m9imum necess>y requirem5ts = ! reque/1 use1 & disclosure ( applicable heal? in=mation & any exceptions4 7,f7 ,/&>ds & requirem5ts relat$ to legal repres5tatives ( ! individual4 7,g7 ,/&>ds & requirem5ts relat$ to s]vice provid]s4 7,h7 ,individual rights ) respect to applicable heal? in=mation1 includ+ ! "r ( ! individual to receive a privacy notice f ! regulat$ entity1 access to applicable heal? in=mation1 am5dm5t ( applicable heal? in=mation1 deletion ( applicable heal? in=mation1 & portability ( applicable heal? in=mation1 & any exceptions to su* rights 7su* z ) respect to applicable heal? in=mation collect$ = rese>* purposes71 any conditions on su* rights1 & any o!r requirem5ts relat$ to su* rights1 includ+ timeframes = respond+ to reque/s4 7,i7 ,adm9i/rative safegu>ds1 includ+ designation ( a privacy (fic]1 policies & proc$ures1 tra9+ ( work=ce memb]s1 non-retaliation1 docum5tation1 & mitigation4 7#b7 ,security requirem5ts1 includ+ ! foll[+3 7,a7 ,physical1 te*nical1 & adm9i/rative safegu>ds = applicable heal? in=mation 9 any =m4 7,b7 ,= electronic applicable heal? in=mation1 su* safegu>ds %all be bas$ on well-e/abli%$ national frameworks1 su* z cyb]security p]=mance goals ( ! ,national ,in/itute ( ,/&>ds & ,te*nology or ! ,dep>tm5t ( ,heal? & ,human ,s]vices4 7#c7 ,brea* notification requirem5ts 9 ! ev5t ( a brea* ( applicable heal? in=mation t are sub/antially simil> to ! brea* notification requirem5ts "u subp>t ,d ( "p #afd ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 7b7 ,en=cem5t au?ority ,! ,secret>y1 9 consultation ) ! ,f$]al ,trade ,commission1 is au?oriz$ to en=ce all provisions ( ?is ,act z describ$ 9 subsection 7c74 7c7 ,civil p5alties ,9 addition to any o!r sanctions or rem$ies t may be available "u any provision ( ,f$]al law1 9 ! case ( a regulat$ entity or s]vice provid] t violates ?is section1 subp>t ,d ( "p #afj ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations71 %all apply to ! regulat$ entity or s]vice provid] ) respect to su* violation ( ?is section 9 ! same mann] t su* subp>t applies to a p]son ) respect to a violation ( "p #afj ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 7d7 ,ext5sion ( ,,hite* ,act am5dm5t to regulat$ entities & s]vice provid]s ,! privacy & security practices "u section #acdab ( ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agida7 %all apply to regulat$ entities & s]vice provid]s ) respect to applicable heal? in=mation 9 ! same mann] t su* section applies to cov]$ entities & bus9ess associates4 7e7 ,def9itions ,9 ?is section3 7#a7 ,applicable heal? in=mation ,! t]m applicable heal? in=mation-- 7,a7 means in=mation 7includ+ demographic in=mation7 t-- 7i7 id5tifies an individual or ) respect to :i* !re is a reasonable basis to believe t ! in=mation c\ld be us$ to id5tify an individual2 & 7ii7 relates to ! pa/1 pres5t1 or future physical or m5tal heal? or condition ( an individual1 ! provision ( heal? c>e to an individual1 or ! pa/1 pres5t1 or future paym5t = ! provision ( heal? c>e to an individual2 & 7,b7 may include in=mation describ$ 9 subp>agraph 7,a7 t 0 n creat$ or receiv$ by a heal? c>e provid]1 heal? plan1 employ]1 or heal? c>e cle>+h\se4 7#b7 ,cov]$ entities2 bus9ess associates ,! t]ms cov]$ entities & bus9ess associates h ! mean+s giv5 su* t]ms 9 section #afj4ajc ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 7#c7 ,regulat$ entity ,! t]m regulat$ entity-- 7,a7 means a natural or legal p]son t1 alone or jo9tly ) o!rs1 det]m9es ! purpose & means ( process+ applicable heal? in=mation2 & 7,b7 does n include-- 7i7 a gov]nm5tal entity su* z a body1 au?ority1 bo>d1 bureau1 commission1 di/rict1 ag5cy1 or political subdivision ( ! ,f$]al1 ,/ate1 or local gov]nm5t2 7ii7 a p]son or an entity t is collect+1 process+1 or transf]r+ cov]$ data on behalf ( or a ,f$]al1 ,/ate1 ,tribal1 t]ritorial1 or local gov]nm5t entity2 & 7iii7 a cov]$ entity or bus9ess associate1 z su* t]ms are def9$ 9 section #afj4ajc ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 7#d7 ,s]vice provid] ,! t]m s]vice provid] means a natural or legal entity t processes applicable heal? in=mation on a behalf ( a regulat$ entity & t is n a cov]$ entity or bus9ess associate1 z su* t]ms are def9$ 9 section #afj4ajc ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 #c4 ,rights & requirem5ts reg>d+ access to c]ta9 protect$ heal? in=mation 7a7 ,"t & mann] ( access ,9 apply+ section #acdje7;e7 ( ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agice7;e77 or section #afd4ebd7;c77#c77;ii7 ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations71 9 ! case t an individual reque/s t a cov]$ entity or any bus9ess associate ( a cov]$ entity transmit1 produce1 or provide access to a copy ( ! individual's protect$ heal? in=mation to a p]son1 includ+ an entity1 designat$ by ! individual1 & except :]e p]mitt$ )\t au?orization "u section #afd4ejf7;c7 ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations7-- 7#a7 ! individual's reque/ %all meet all requirem5ts ( a valid au?orization "u section #afd4ejh7;b7 ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations72 & 7#b7 ! cov]$ entity or bus9ess associate may condition ! transmittal1 production1 or provision ( access ^u ! p]son to :om ! in=mation is to be transmitt$ or produc$ or to :om access is to be provid$-- 7,a7 pay+ fees1 9 accordance ) applicable ,/ate law & consi/5t ) subsection 7b71 9 advance ( su* transmittal1 production1 or access2 & 7,b7 ackn[l$g+ & accept+ ! t]ms1 limitations1 & conditions ( use & disclosure conta9$ 9 ! reque/ made by ! individual z ! legally b9d+ obligation ( ! p]son receiv+ ! in=mation4 7b7 ,fees 7#a7 ,9 g5]al ,9 apply+ section #acdje7;e77#c7 ( ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agice7;e77#c77 or section #afd4ebd7;c77#d7 ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations71 ea* su* section %all apply only-- 7,a7 to ! provision ( access to1 or ! production1 copy+1 or transmittal (1 protect$ heal? in=mation directly to-- 7i7 ! individual1 or ! individual's p]sonal repres5tative = heal? c>e purposes z describ$ 9 section #afd4ejb7;g7 ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations72 7ii7 subject to p>agraph 7#b7 & section #afd4eaj7;b7 ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulation71 any o!r p]son id5tifi$ 91 & subject to ! limitations (1 su* section2 or 7iii7 ! individual's heal? c>e provid] or ! bus9ess associates ( su* provid]2 & 7,b7 z direct$ by ! individual1 to ! electronic transmittal ( ! individual's electronic heal? record to ! pati5t portal or mobile m$ical application us$ & ma9ta9$ by ! individual's heal? c>e provid] or = ! heal? c>e provid] by its bus9ess associate4 7#b7 ,additional limitations ,9 ! case ( ! provision ( access to1 or ! production1 copy+1 or transmittal (1 protect$ heal? in=mation "u p>agraph 7#a77;,a7 directly to a p]son describ$ 9 clause 7ii7 ( su* p>agraph1 su* protect$ heal? in=mation %all1 9 accordance ) section #afd4eaj7;b7 ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations71 be limit$ to only su* in=mation t is-- 7,a7 directly relevant to ! p]son's involvem5t ) ! c>e ( ! individual or ) ! paym5t relevant to ! c>e ( ! individual2 or 7,b7 ne$$ = notification purposes describ$ 9 su* section4 7c7 ,def9itions ,9 ?is section1 ! t]ms bus9ess associate1 cov]$ entity1 heal? c>e provid]1 individual1 p]son1 & protect$ heal? in=mation h ! mean+s giv5 su* t]ms 9 section #afj4ajc ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 7d7 ,guidance ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y ( ,heal? & ,human ,s]vices %all am5d exi/+ guidance z necess>y to implem5t subsections 7a7 & 7b74 #d4 ,confid5tiality ( records ,section #edc ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #bij;dd-#b7 is am5d$-- 7#a7 9 subsection 7a71 by /rik+ subsection 7b7 & ins]t+ ! ,,hipaa regulations2 7#b7 9 subsection 7b7-- 7,a7 9 p>agraph 7#b71 by r$esignat+ subp>agraphs 7,a7 ?r\gh 7,d7 z p>agraphs 7#a7 ?r\gh 7#d71 respectively1 & adju/+ ! m>g9s accord+ly2 & 7,b7 by /rik+ 7b7 ,p]mitt$ disclosure & all t foll[s ?r\gh 7#b7 ,me?od = disclosure--,:e!r & ins]t+ ! foll[+3 7b7 ,p]mitt$ disclosure ,:e!r 2 7#c7 9 subsection 7c71 9 ! matt] prec$+ p>agraph 7#a71 by /rik+ subsection 7b77#b77;,c7 & ins]t+ subsection 7b77#c72 & 7#d7 9 subsection 7g71 by /rik+ subsection 7b77#b77;,c7 & ins]t+ subsection 7b77#c74 #e4 ,,nas /udy on comp5sation to pati5ts = %>+ id5tifiable data = rese>* purposes 7a7 ,9 g5]al ,n lat] ?an #fj days aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y ( ,heal? & ,human ,s]vices %all seek to ent] into a contract ) ! ,national ,academies ( ,sci5ces1 ,eng9e]+1 & ,m$ic9e to conduct a /udy exam9+ pot5tial risks & b5efits ( pay+ comp5sation to pati5ts = %>+ _! id5tifiable data = rese>* purposes4 7b7 ,inclusions ,! /udy conduct$ pursuant to ! contract "u subsection 7a7 %all include an exam9ation (-- 7#a7 ! risks to pati5t privacy pos$ by ! integration ( id5tifiable1 de-id5tifi$1 & aggregat$ heal? in=mation into datasets us$ = rese>*2 7#b7 privacy enhanc+ tools & me?ods = ! protection ( pati5t heal? data2 7#c7 ! feasibility ( track+ pati5t data & cons5t = ! integration ( pati5t heal? data into datasets us$ = rese>*2 7#d7 e?ical consid]ations = comp5sat+ pati5ts = use ( _! id5tifiable & de-id5tifi$ heal? data2 7#e7 :e!r ! exi/+ exemptions p]mitt+ de-id5tifi$ data to be us$ = rese>* %\ld consid] :e!r a pati5t 0 giv5 an opportunity to opt-9 or opt-out ( p>ticipation2 & 7#f7 risk ( re-id5tification ( de-id5tifi$ data4 #f4 ,pati5t notification requirem5ts "u ! ,,hipaa privacy regulations 7a7 ,pati5t notification ^u removal ,any regulat$ entity or s]vice provid] :o ga9s access to ! protect$ heal? in=mation ( an individual ?r\gh ! pati5t "r ( access "u section #afd4ebd ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations7 %all-- 7#a7 provide a writt5 pla9 language notification to su* individual prior to access+ su* in=mation-- 7,a7 t su* protect$ heal? in=mation w no long] be subject to ! protections "u ! ,,hipaa privacy regulation2 & 7,b7 t includes an explanation ( h[ & to :i* entities su* protect$ heal? in=mation may be r$isclos$2 & 7#b7 require ! cons5t ( ! individual be=e sell+ su* protect$ heal? in=mation to ?ird p>ties4 7b7 ,pati5t notification reg>d+ wellness data 7#a7 ,9 g5]al ,any regulat$ entity or s]vice provid] :o (f]s digital te*nology t g5]ates wellness data ab\t individuals %all1 ) respect to ea* individual :o uses su* te*nology-- 7,a7 provide a writt5 pla9 language notification to ! individual 9 advance ( initiat+ ! g5]ation ( su* data t su* data w n be subject to ! protections ( ! ,,hipaa privacy regulation2 & 7,b7 (f] ! individual an opportunity to opt out ( su* wellness data g5]ation4 7#b7 ,wellness data ,9 ?is subsection1 ! t]m wellness data means data g5]at$ = ! purpose ( promot+ heal? or prev5t+ disease1 :i* may include vital /ati/ics1 /ep c\nts1 & m$ical regim5 compliance4 7c7 ,def9itions ,9 ?is section-- 7#a7 ! t]ms bus9ess associate1 cov]$ entity1 & protect$ heal? in=mation h ! mean+s giv5 su* t]ms 9 section #afj4ajc ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations72 7#b7 ! t]m ,,hipaa privacy regulation has ! mean+ giv5 su* t]m 9 section #aahj7;b77#c7 ( ! ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d-#i7;b77#c772 & 7#c7 ! t]ms regulat$ entity & s]vice provid] h ! mean+s giv5 su* t]ms 9 section #b4 7d7 ,effective date ,?is section %all take effect beg9n+ "o ye> aft] ! date ( enactm5t ( ?is ,act4 #g4 ,m9imum necess>y guidance ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y ( ,heal? & ,human ,s]vices %all publi% guidance on ! application ( ! m9imum necess>y /&>d to data us$ = artificial intellig5ce & o!r ma*9e le>n+ applications & relevant requirem5ts1 includ+ heal? data int]op]ability requirem5ts "u section #cjja7;c77#i7 ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #cjj;jj-#aa7;c77#i77 & ! use ( limit$ data sets pursuant to section #acdje7;b7 ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agice7;b774 #h4 ,de-id5tifi$ in=mation 7a7 ,e/abli%m5t ( /&>ds ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y ( ,heal? & ,human ,s]vices %all promulgate regulations e/abli%+ unifi$ national /&>ds = r5d]+ applicable heal? in=mation z de-id5tifi$ in=mation1 9 a mann] simil> to ! mann] 9 :i* individually id5tifiable heal? in=mation may be r5d]$ de-id5tifi$ in=mation pursuant to "p #afd ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 7b7 ,composition ( /&>ds ,su* /&>ds %all-- 7#a7 be at lea/ equival5t to or exce$ ! de-id5tification /&>d specifi$ 9 section #afd4ead7;b7 ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations72 7#b7 specify /&>ds = ! use ( privacy-enhanc+ te*nologies z a me?od = creat+ de-id5tifi$ in=mation2 & 7#c7 specify t in=mation %all n qualify z de-id5tifi$ in=mation :5 provid$ by a regulat$ entity1 s]vice provid]1 cov]$ entity1 or bus9ess associate to ano!r p]son or entity unless su* p]son or entity contractually agrees 9 writ+ n to re-id5tify or attempt to re-id5tify ! in=mation1 & to require ! same ( any p]son or entity to :om su* p]son or entity provides ! in=mation4 7c7 ,def9itions ,9 ?is section-- 7#a7 ! t]m applicable heal? in=mation has ! mean+ giv5 su* t]m 9 section #b2 7#b7 ! t]ms bus9ess associate1 cov]$ entity1 & individually id5tifiable heal? in=mation h ! mean+s giv5 su* t]ms 9 section #afj4ajc ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations72 & 7#c7 ! t]m privacy enhanc+ te*nologies means any s(tw>e or h>dw>e solution1 te*nical process1 or o!r te*nological means ( mitigat+ individuals' privacy risks aris+ f data process+ by enhanc+ pr$ictability1 manageability1 disassociability1 & confid5tiality4 #i4 ,preemption ,section #afj4bjc ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations7 %all apply to ! requirem5ts set =? "u ?is ,act 9 ! same mann] & to ! same ext5t z su* section applies to ! /&>ds1 requirem5ts1 & implem5tation specifications "u sub*apt] ,c ( *apt] ,i ( subtitle ,a ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 #a4 ,%ort title ,?is ,act may be cit$ z ! ,heal? ,in=mation ,privacy ,re=m ,act4 #b4 ,protections = applicable heal? in=mation 7a7 ,9 g5]al ,n lat] ?an #ah mon?s aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y ( ,heal? & ,human ,s]vices 7ref]r$ to 9 ?is section z ! ,secret>y71 9 consultation ) ! ,f$]al ,trade ,commission1 %all promulgate regulations e/abli%+ & implem5t+ privacy1 security1 & brea* notification /&>ds = ! process+ ( applicable heal? in=mation by regulat$ entities & _! s]vice provid]s4 ,su* /&>ds %all provide rights & protections t are at lea/ equival5t to1 & t1 :]ev] feasible & appropriate1 h>monize )1 ! rights & protections provid$ ?r\gh ! privacy1 security1 & brea* notification rules promulgat$ "u section #bfd7;c7 ( ! ,heal? ,insurance ,portability & ,acc\ntability ,act ( #aiif 7#db ,u4,s4,c4 #acbj;d-#b note7 & section #acdjb ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agicb7 t apply to cov]$ entities & bus9ess associates ) respect to protect$ heal? in=mation "u su* rules4 ,su* regulations promulgat$ "u ?is section %all include ! foll[+3 7#a7 ,privacy requirem5ts1 includ+ ! foll[+3 7,a7 ,p]mitt$ uses & disclosures ( applicable heal? in=mation )\t an individual's writt5 au?orization t are consi/5t ) ! individual's reasonable expectations1 tak+ into consid]ation ! context 9 :i* ! applicable heal? in=mation 0 obta9$1 provid$ t su* regulations %all n au?orize su* a use or disclosure to inve/igate1 or to impose liability on1 any individual 9 connection ) ! seek+1 obta9+1 provid+1 or facilitat+ ( heal? c>e4 7,b7 ,uses & disclosures ( applicable heal? in=mation t require ! individual's writt5 au?orization & ! requirem5ts relat$ to su* writt5 au?orizations1 includ+ h[ ! individual may revoke su* au?orization1 :i* %all include requir+ ! individual's writt5 au?orization = any sale1 lic5s+1 transf]1 or m>ket+ ( applicable heal? in=mation4 7,c7 ,prohibit$ uses & disclosures ( applicable heal? in=mation4 7,d7 ,m9imum necess>y requirem5ts = ! reque/1 use1 & disclosure ( applicable heal? in=mation & any exceptions t are necess>y = purpose specification1 collection limitation1 data m9imization1 & limitation on second>y use & t are consi/5t ) subsection 7b74 7,e7 ,/&>ds & requirem5ts = an individual to be au?oriz$ to ex]cise ! rights grant$ 9 ?is section ) respect to applicable heal? in=mation ( ano!r individual4 7,f7 ,/&>ds & requirem5ts relat$ to s]vice provid]s4 7,g7 7i7 ,individual rights ) respect to applicable heal? in=mation1 includ+ ! foll[+3 7,i7 ,! "r ( ! individual to receive a privacy notice f ! regulat$ entity1 :i* %all describe ! purposes = :i* ! regulat$ entity uses & discloses applicable heal? in=mation1 ! rights ( ! individual "u ?is subp>agraph1 & ! mann] 9 :i* su* rights may be ex]cis$4 7,,ii7 ,! "r ( access to applicable heal? in=mation1 includ+ ! ability ( ! individual to direct ! transmission ( applicable heal? in=mation held 9 an electronic heal? record to a ?ird p>ty4 7,,iii7 ,! "r to am5dm5t ( applicable heal? in=mation4 7,,iv7 ,! "r to deletion ( applicable heal? in=mation1 n lat] ?an #cj days aft] ! regulat$ entity or s]vice provid] receives a reque/ = su* a deletion1 & all[+ = ! regulat$ entity or s]vice provid] to communicate ) ! individual mak+ su* reque/ prior to fulfill+ su* reque/4 7,v7 ,! "r to portability ( applicable heal? in=mation1 includ+ ! ability ( ! individual to transf] su* in=mation betwe5 applications1 s]vices1 or devices4 7ii7 ,any exception to1 or condition or o!r requirem5t on1 a "r describ$ 9 any ( subclauses 7,i7 ?r\gh 7,v7 ( clause 7i71 includ+ an exception ) respect to applicable heal? in=mation collect$ = rese>* purposes & a timeframe = respond+ to a reque/ ( an individual = applicable heal? in=mation4 7,h7 ,adm9i/rative safegu>ds1 includ+ designation ( a privacy (fic]1 policies & proc$ures1 tra9+ ( work=ce memb]s1 non-retaliation1 docum5tation1 & mitigation4 7#b7 ,security requirem5ts1 includ+ ! foll[+3 7,a7 ,physical1 te*nical1 & adm9i/rative safegu>ds = applicable heal? in=mation 9 writt5 or oral =m4 7,b7 ,! application ( ! /&>ds "u subp>t ,c ( "p #afd ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations7 to electronic applicable heal? in=mation 9 ! same mann] z su* /&>ds apply to electronic protect$ heal? in=mation4 7#c7 ,brea* notification requirem5ts 9 ! ev5t ( a brea* ( applicable heal? in=mation t are sub/antially simil> to ! brea* notification requirem5ts "u subp>t ,d ( "p #afd ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations7 = applicable heal? in=mation t is n subject to ! heal? brea* notification rule at "p #cah ( title #af1 ,code ( ,f$]al ,regulations 7or any successor regulations74 7b7 ,requirem5ts = regulat$ entities & s]vice provid]s 7#a7 ,data m9imization ,a regulat$ entity or s]vice provid] may n collect1 process1 or transf] applicable heal? in=mation beyond :at a cov]$ entity is p]mitt$ to collect1 process1 or transf] "u sections #afd4ejb7;b7 & #afd4ead7;d7 ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 7#b7 ,ret5tion ,a regulat$ entity or s]vice provid] may n reta9 applicable heal? in=mation = long] ?an is reasonably necess>y to c>ry out ! purpose = :i* su* in=mation 0 collect$4 7#c7 ,exceptions ,p>agraphs 7#a7 & 7#b7 %all n apply to ! collection1 process+1 or transf] ( applicable heal? in=mation to ! ext5t reasonably necess>y = any ( ! foll[+ purposes3 7,a7 ,to complete a transaction or provide a product or s]vice specifically reque/$ by ! individual to :om su* in=mation relates4 7,b7 ,to comply ) a legal obligation1 or to e/abli%1 ex]cise1 or def5d a legal claim4 7,c7 ,to prev5t1 detect1 or respond to a security incid5t1 fraud1 or h>m to an individual4 7,d7 ,to c>ry out a public heal? activity p]mitt$ "u ! regulations promulgat$ "u subsection 7a74 7,e7 ,to conduct rese>* subject to "p #df ( title #de1 ,code ( ,f$]al ,regulations1 or "p #ej or #ef ( title #ba1 ,code ( ,f$]al ,regulations 7or any successor regulations74 7c7 ,en=cem5t 7#a7 ,coord9ation ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y & ! ,f$]al ,trade ,commission %all ent] into a memor&um ( und]/&+ t allocates prim>y en=cem5t responsibility "u ?is section1 provides = mutual notification ( inve/igations into violations ( ?is section1 & ensures t a regulat$ entity or s]vice provid] is n subject to duplicative civil p5alties = ! same act or omission4 7#b7 ,rule ( con/ruction ,no?+ 9 ?is ,act %all be con/ru$ to limit or sup]s$e ! au?ority ( ! ,f$]al ,trade ,commission "u section #e ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de74 7#c7 ,civil p5alties ,9 addition to any o!r sanctions or rem$ies t may be available "u any provision ( ,f$]al law1 9 ! case ( a regulat$ entity or s]vice provid] t violates ?is section1 subp>t ,d ( "p #afj ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations7 %all apply to ! regulat$ entity or s]vice provid] ) respect to su* violation ( ?is section 9 ! same mann] t su* subp>t applies to a p]son ) respect to a violation ( "p #afj1 #afb1 or #afd ( sub*apt] ,c ( *apt] ,i ( subtitle ,a ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 ,any funds collect$ ?r\gh civil p5alties "u ?is p>agraph %all be us$ to support en=cem5t activity "u ?is section4 7d7 ,ext5sion ( ,,hite* ,act am5dm5t to regulat$ entities & s]vice provid]s ,! privacy & security practices "u section #acdab ( ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agida7 %all apply to regulat$ entities & s]vice provid]s ) respect to applicable heal? in=mation 9 ! same mann] t su* section applies to cov]$ entities & bus9ess associates4 ,n lat] ?an #ah mon?s aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y %all promulgate regulations to c>ry out ?is subsection4 7e7 ,gov]nm5t access ,a regulat$ entity or s]vice provid] may n sell or o!rwise transf] applicable heal? in=mation to a ,f$]al1 ,/ate1 local1 ,tribal1 or t]ritorial gov]nm5tal entity except z compell$ by w>rant1 subpo5a1 c\rt ord]1 or o!r compulsory process4 7f7 ,def9itions ,9 ?is section3 7#a7 ,applicable heal? in=mation ,! t]m applicable heal? in=mation-- 7,a7 means in=mation 7includ+ demographic in=mation7-- 7i7 t id5tifies an individual or ) respect to :i* !re is a reasonable basis to believe t ! in=mation c\ld be us$ to id5tify an individual2 & 7ii7 t relates to ! pa/1 pres5t1 or future physical or m5tal heal? or condition ( su* individual1 ! pa/1 pres5t1 or future provision ( heal? c>e to su* individual1 or pa/1 pres5t1 or future paym5t = ! provision ( heal? c>e to su* individual2 7,b7 includes-- 7i7 in=mation describ$ 9 subp>agraph 7,a7 t 0 n creat$ or receiv$ by a heal? c>e provid]1 heal? plan1 employ]1 or heal? c>e cle>+h\se2 & 7ii7 precise geolocation in=mation t c\ld reasonably indicate an attempt by an individual to acquire or receive a heal? s]vice or supply2 & 7,c7 does n include-- 7i7 in=mation subject to-- 7,i7 title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq472 7,,ii7 ! requirem5ts reg>d+ ! confid5tiality ( sub/ance use disord] in=mation "u section #edc ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #bij;dd-#b72 7,,iii7 section #ddd ( ! ,g5]al ,education ,provisions ,act 7#bj ,u4,s4,c4 #abcb;g2 commonly kn[n z ! ,family ,educational ,rights & ,privacy ,act ( #aigd7 & "p #ii ( title #cd1 ,code ( ,f$]al ,regulations 7or any successor regulations7 to ! ext5t su* regulat$ entity or s]vice provid] is an educational ag5cy or in/itution z def9$ 9 su* section ( su* ,act or section #ii4c ( title #cd1 ,code ( ,f$]al ,regulations 7or any successor regulations72 7,,iv7 provisions = ! protection ( id5tifiable private in=mation t is collect$ pursuant to-- 7aa7 ! ,f$]al requirem5ts = ! protection ( human subjects "u "p #df ( title #de1 ,code ( ,f$]al ,regulations or "p #ej or #ef ( title #ba1 ,code ( ,f$]al ,regulations 7or any successor regulations72 or 7bb7 ! good cl9ical practice guidel9es issu$ by ! ,int]national ,c\ncil = ,h>monisation ( ,te*nical ,requirem5ts = ,ph>maceuticals = ,human ,use2 7,v7 ! ,heal? ,c>e ,quality ,improvem5t ,act ( #aihf 7#db ,u4,s4,c4 #aaaja et seq472 or 7,,vi7 "p ,c ( title ,,ix ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #bii;b-#ba et seq472 7ii7 publicly available in=mation2 or 7iii7 in=mation collect$1 process$1 or transf]r$ by an individual 9 ! c\rse ( a purely p]sonal or h\sehold activity4 7#b7 ,cov]$ entities2 bus9ess associates ,! t]ms cov]$ entities & bus9ess associates h ! mean+s giv5 su* t]ms 9 section #afj4ajc ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 7#c7 ,data brok] ,! t]m data brok] means a regulat$ entity ^: pr9cipal s\rce ( rev5ue is d]iv$ f process+ or transf]r+ applicable heal? in=mation t ! entity did n collect directly f ! individuals to :om su* in=mation relates4 7#d7 ,regulat$ entity ,! t]m regulat$ entity-- 7,a7 means a natural or legal p]son1 includ+ a data brok]1 t1 alone or jo9tly ) o!rs1 det]m9es ! purpose & means ( process+ applicable heal? in=mation2 & 7,b7 does n include-- 7i7 a cov]$ entity or bus9ess associate1 ) respect to protect$ heal? in=mation2 or 7ii7 an individual :o is ! subject ( ! applicable heal? in=mation or :o obta9s applicable heal? in=mation 9 a p]sonal or h\sehold capacity4 7#e7 ,s]vice provid] ,! t]m s]vice provid] means a natural or legal entity t processes applicable heal? in=mation on behalf ( a regulat$ entity & t is n a cov]$ entity or bus9ess associate4 7g7 ,regulations ,! ,secret>y may promulgate regulations to c>ry out ?is section4 #c4 ,rights & requirem5ts reg>d+ access to c]ta9 protect$ heal? in=mation 7a7 ,"t & mann] ( access ,9 apply+ section #acdje7;e7 ( ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agice7;e77 or section #afd4ebd7;c77#c77;ii7 ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations71 9 ! case t an individual reque/s t a cov]$ entity or any bus9ess associate ( a cov]$ entity transmit1 produce1 or provide access to a copy ( ! individual's protect$ heal? in=mation 9 an electronic heal? record to a p]son designat$ by ! individual1 ! cov]$ entity or bus9ess associate may condition ! transmittal1 production1 or provision ( access ^u ! p]son to :om ! in=mation is to be transmitt$ or produc$ or to :om access is to be provid$-- 7#a7 pay+ fees1 9 accordance ) applicable ,/ate law & consi/5t ) subsection 7b71 9 advance ( su* transmittal1 production1 or access2 & 7#b7 ackn[l$g+ & accept+ ! t]ms1 limitations1 & conditions ( use & disclosure conta9$ 9 ! reque/ made by ! individual z ! legally b9d+ obligation ( ! p]son receiv+ ! in=mation4 7b7 ,fees ,9 apply+ section #acdje7;e77#c7 ( ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agice7;e77#c77 or section #afd4ebd7;c77#d7 ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations71 ea* su* section %all apply only to ! provision ( access to1 or ! production1 copy+1 or transmittal (1 protect$ heal? in=mation to-- 7#a7 ! individual1 or ! individual's p]sonal repres5tative2 7#b7 ! individual's heal? c>e provid] or ! bus9ess associates ( su* provid]2 or 7#c7 a p]sonal heal? record manag$ & controll$ by ! individual4 7c7 ,def9itions ,9 ?is section-- 7#a7 ! t]ms bus9ess associate1 cov]$ entity1 heal? c>e provid]1 individual1 p]son1 & protect$ heal? in=mation h ! mean+s giv5 su* t]ms 9 section #afj4ajc ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations72 & 7#b7 ! t]m p]sonal heal? record has ! mean+ giv5 su* t]m 9 section #acdjj ( ! ,heal? ,in=mation ,te*nology = ,economic & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4 #agiba74 7d7 ,guidance ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y ( ,heal? & ,human ,s]vices %all am5d exi/+ guidance z necess>y to implem5t subsections 7a7 & 7b74 7e7 ,rules ( con/ruction ,no?+ 9 ?is section %all be con/ru$ to-- 7#a7 p]mit a cov]$ entity or bus9ess associate to d5y1 delay1 or condition a transmission direct$ by an individual 9 a mann] t con/itutes in=mation block+ "u section #cjbb ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #cjj;jj-#eb7 or "p #aga ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations72 7#b7 treat an individual or ! individual's p]sonal repres5tative :o receives or accesses ! individual's protect$ heal? in=mation on ! individual's behalf & at ! direction ( ! individual z a p]son to :om a fee or condition may be appli$ "u subsection 7a71 ) respect to a p]sonal heal? record t is select$1 manag$1 & controll$ by ! individual or ! individual's p]sonal repres5tative2 or 7#c7 alt] ! rights or responsibilities ( cov]$ entities & individuals "u section #acdje7;e7 ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agice74 #d4 ,m9imum necess>y guidance 7a7 ,rulemak+ ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y ( ,heal? & ,human ,s]vices 7ref]r$ to 9 ?is section z ! ,secret>y71 9 coord9ation ) ! ,commission] ( ,food & ,drugs & ! ,national ,coord9ator = ,heal? ,in=mation ,te*nology1 %all promulgate regulations reg>d+ ! application ( ! m9imum necess>y /&>d "u section #afd4ejb7;b7 ( title #de1 ,code ( ,f$]al ,regulations1 to applicable heal? in=mation & protect$ heal? in=mation1 includ+ su* in=mation us$ to tra91 develop1 validate1 modify1 or op]ate an artificial intellig5ce or o!r ma*9e le>n+ model4 7b7 ,cont5ts ,! regulations promulgat$ "u subsection 7a7 %all-- 7#a7 cl>ify t su* m9imum necess>y /&>d does n p]mit a cov]$ entity1 bus9ess associate1 regulat$ entity1 or s]vice provid] to d5y1 delay1 or condition a use or disclosure t is o!rwise requir$ or p]mitt$1 includ+ a disclosure requir$ "u section #cjbb ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #cjj;jj-#eb71 on ! gr\nd t limit+ ! disclosure to ! m9imum necess>y in=mation is n te*nically feasible1 &1 z applicable1 ! m9imum necess>y /&>d is satisfi$ by reasonable ef=ts to limit ! in=mation us$ or disclos$1 ev5 :]e fur!r te*nical limitation is n feasible2 7#b7 specify h[ ! m9imum necess>y /&>d applies to ! use ( applicable heal? in=mation & protect$ heal? in=mation to develop1 tra91 validate1 or f9e-tune an artificial intellig5ce or ma*9e le>n+ model1 includ+ ! circum/ances "u :i* ! use ( a l>g] data set is reasonably necess>y = su* developm5t1 & ! ext5t to :i* de-id5tification1 data m9imization1 or privacy-enhanc+ te*nologies satisfy ! /&>d2 & 7#c7 address ! m9imum necess>y /&>d ) respect to ! heal? data int]op]ability requirem5ts "u sections #cjja7;c77#i7 & #cjbb ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #cjj;jj-#aa7;c77#i71 #cjj;jj-#eb7 & "p #aga ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 7c7 ,p]iodic review ,! ,secret>y %all review1 & update z appropriate1 ! regulations promulgat$ "u subsection 7a7 n less frequ5tly ?an once e #c ye>s4 #e4 ,de-id5tifi$ in=mation 7a7 ,e/abli%m5t ( /&>ds ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y ( ,heal? & ,human ,s]vices %all promulgate regulations e/abli%+ unifi$ national /&>ds = r5d]+ applicable heal? in=mation z de-id5tifi$ in=mation1 9 a mann] simil> to ! mann] 9 :i* individually id5tifiable heal? in=mation may be r5d]$ de-id5tifi$ in=mation pursuant to "p #afd ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 7b7 ,composition ( /&>ds ,! /&>ds "u subsection 7a7 %all-- 7#a7 be at lea/ z protective z ! de-id5tification /&>d specifi$ 9 section #afd4ead7;b77#a7 ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations7 7relat+ to exp]t det]m9ation71 & may n p]mit in=mation to be r5d]$ de-id5tifi$ in=mation solely ?r\gh ! me?od specifi$ 9 section #afd4ead7;b77#b7 ( su* title 7relat+ to safe h>bor72 7#b7 specify /&>ds = ! use ( privacy-enhanc+ te*nologies z a me?od = creat+ de-id5tifi$ in=mation2 7#c7 specify t in=mation %all n qualify z de-id5tifi$ in=mation :5 provid$ by a regulat$ entity1 s]vice provid]1 cov]$ entity1 or bus9ess associate to ano!r p]son or entity unless su* p]son or entity contractually agrees 9 writ+ n to re-id5tify or attempt to re-id5tify ! in=mation1 & to require ! same ( any p]son or entity to :om su* p]son or entity provides ! in=mation2 & 7#d7 acc\nt = evolv+ me?ods ( re-id5tification1 includ+ me?ods t use artificial intellig5ce or ma*9e le>n+4 7c7 ,prohibition on re-id5tification ,an entity t is ! recipi5t ( de-id5tifi$ in=mation may n re-id5tify1 or attempt to re-id5tify1 su* in=mation4 ,a violation ( ?is subsection %all be en=ceable & subject to ! civil p5alties "u section #b7;c74 7d7 ,def9itions ,9 ?is section-- 7#a7 ! t]m applicable heal? in=mation has ! mean+ giv5 su* t]m 9 section #b2 7#b7 ! t]ms bus9ess associate1 cov]$ entity1 & individually id5tifiable heal? in=mation h ! mean+s giv5 su* t]ms 9 section #afj4ajc ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations72 & 7#c7 ! t]m privacy-enhanc+ te*nologies means any s(tw>e or h>dw>e solution1 te*nical process1 or o!r te*nological means ( mitigat+ individuals' privacy risks aris+ f data process+ by enhanc+ pr$ictability1 manageability1 disassociability1 & confid5tiality4 #f4 ,preemption ,section #afj4bjc ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations7 %all apply to ! requirem5ts set =? "u ?is ,act 9 ! same mann] & to ! same ext5t z su* section applies to ! /&>ds1 requirem5ts1 & implem5tation specifications "u sub*apt] ,c ( *apt] ,i ( subtitle ,a ( title #de1 ,code ( ,f$]al ,regulations 7or any successor regulations74 ,augu/ #d1 #bjbf,report$ ) an am5dm5t