S3097-119

What This Bill Does

The reported Health Information Privacy Reform Act directs the Department of Health and Human Services, in consultation with the Federal Trade Commission, to issue rules within 18 months for identifiable health information that is handled outside ordinary HIPAA coverage. The rules must provide privacy, security, and breach-notification protections at least equivalent to the HIPAA and HITECH framework where feasible. The covered information includes identifiable physical or mental health, health-care, and payment information, including precise geolocation that could indicate an attempt to obtain a health service. Regulated entities include health-data businesses and data brokers that determine how such information is processed; service providers processing the data for them are also covered.

The rules must specify permitted, authorized, and prohibited uses; impose minimum-necessary, purpose-limitation, data-minimization, and secondary-use limits; and establish privacy notices plus rights of access, correction, deletion, and portability. Written authorization is required for sale, licensing, transfer, or marketing, and it must be revocable. Deletion ordinarily must occur within 30 days, subject to regulatory exceptions and an opportunity for the business to communicate with the requester. Entities must appoint privacy personnel, train workers, maintain policies and records, avoid retaliation, mitigate violations, and use physical, technical, and administrative safeguards. They may not retain data longer than reasonably needed. Exceptions preserve necessary processing for requested transactions, legal obligations or claims, security and fraud response, public health, and regulated research.

The bill also bars a regulated entity or service provider from selling or transferring covered health information to a federal, state, local, Tribal, or territorial government unless compelled by a warrant, subpoena, court order, or other compulsory process. Permitted-use rules may not authorize health-data use to investigate or impose liability on a person for seeking, obtaining, providing, or facilitating health care. HHS and the FTC must allocate primary enforcement responsibility through a memorandum of understanding, share notice of investigations, and prevent duplicate civil penalties for the same conduct. HIPAA-style civil penalties apply, and collected penalties fund enforcement. Existing FTC Act authority remains intact.

For protected health information already governed by HIPAA, the bill clarifies requests to send electronic health records to a person chosen by the individual. A covered entity or business associate may require the designated recipient to pay a state-law-consistent fee in advance and accept binding use and disclosure conditions. Preferential access and copying rules are limited to the individual or personal representative, the person's health-care provider, or a personal health record controlled by the individual. The provision cannot be used for information blocking, and no fee or recipient condition may be imposed when the individual or personal representative receives the data through a personally controlled health record. HHS must update guidance within 180 days.

Within one year, HHS must coordinate with the Food and Drug Administration and the National Coordinator for Health Information Technology to regulate how the minimum-necessary standard applies when health information is used to train, develop, validate, modify, fine-tune, or operate artificial-intelligence and machine-learning models. The rules must explain when larger datasets are reasonably necessary and how de-identification, minimization, and privacy-enhancing technologies satisfy the standard. They must also protect lawful interoperability: an entity cannot deny or delay an otherwise required or permitted disclosure merely because further technical limitation is infeasible when reasonable limiting efforts were made. HHS must review these rules at least every three years.

HHS must separately establish unified national de-identification standards. Those standards must be at least as protective as HIPAA's expert-determination method and cannot rely solely on the HIPAA safe-harbor method. Transfers of purportedly de-identified information require written downstream promises against re-identification, and recipients are directly prohibited from attempting re-identification. The standards must account for evolving AI-assisted re-identification methods and specify privacy-enhancing technologies. Violations are subject to the bill's civil-penalty framework.

The bill excludes information already governed by specified financial, substance-use-disorder, education, human-subject research, clinical-research, health-quality, and patient-safety regimes, along with public information and purely personal or household processing. HIPAA covered entities and business associates are excluded only with respect to protected health information. Its preemption clause imports the existing HIPAA preemption rule, so conflicting state requirements may be displaced while state protections that fit HIPAA's exceptions, including qualifying more protective rules, can remain.

The introduced version also proposed a National Academies study on compensating patients for research data and separate notices for recipients of patient-access data and wellness-technology users. Those standalone sections do not appear in the reported substitute and are not part of the current bill.

Who Benefits and How

Patients and users of health applications gain baseline rights over identifiable health information that may fall outside HIPAA, including access, correction, deletion, portability, authorization, breach notice, and security protections. People seeking sensitive health care gain an express restriction on investigative uses and government transfers without compulsory legal process. Individuals using personally controlled health records receive protection against fees and recipient conditions. Health-care providers and patients may benefit from the interoperability safeguard when technical data minimization is not feasible. Privacy-enhancing-technology vendors and expert de-identification services may gain demand as businesses adapt to the new standards. HHS and the FTC gain clear enforcement authority and dedicated use of collected penalties.

Who Bears the Burden and How

Health applications, wearable-device platforms, digital-health companies, health-data brokers, analytics firms, and their service providers must redesign consent, notices, retention, deletion, portability, security, breach response, vendor contracts, and data governance. Purchasers and recipients of de-identified health data must accept contractual restrictions and face civil penalties for re-identification attempts. Covered entities, business associates, personal-health-record recipients, and health-data intermediaries must distinguish fee-protected individual access from transfers to designated third parties. AI developers and model operators using health information must document why datasets are reasonably necessary and implement updated minimization or privacy technologies. HHS, the FTC, FDA, and the National Coordinator must write, coordinate, enforce, and periodically update several new regulatory regimes.

Key Provisions

• Requires HHS and the FTC to establish HIPAA-equivalent privacy, security, breach, authorization, deletion, portability, minimization, and retention rules for applicable health information.
• Prohibits government transfers without compulsory process and prevents permitted-use rules from authorizing health-care investigations or liability.
• Clarifies electronic-health-record transfers, third-party fees and conditions, personally controlled records, and information-blocking safeguards.
• Requires recurring minimum-necessary rules for health information used by artificial-intelligence and machine-learning systems.
• Replaces safe-harbor-only de-identification with expert-level standards, downstream contracts, privacy-enhancing technologies, and a direct ban on re-identification.
• Applies HIPAA-style civil penalties, coordinates HHS and FTC enforcement, preserves FTC authority, and imports HIPAA's preemption framework.