Public Health Emergency Privacy Act

II 117TH CONGRESS 1ST SESSION S. 81 To protect the privacy of health information during a national health emergency. IN THE SENATE OF THE UNITED STATES JANUARY 28, 2021 Mr. BLUMENTHAL (for himself, Mr. WARNER, Mr. MARKEY, Ms. BALDWIN, Ms. HIRONO, Mr. BOOKER, Mr. MENENDEZ, Mr. KING, Mr. BENNET, Ms. WARREN, Ms. KLOBUCHAR, and Mr. DURBIN) introduced the fol- lowing bill; which was read twice and referred to the Committee on Health, Education, Labor, and Pensions A BILL To protect the privacy of health information during a national health emergency. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Public Health Emer- 4 gency Privacy Act’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 VerDate Sep 11 2014 19:04 Feb 09, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S81.IS S81 pamtmann on DSKBC07HB2PROD with BILLS 2 •S 81 IS (1) AFFIRMATIVE EXPRESS CONSENT.—The 1 term ‘‘affirmative express consent’’ means an affirm- 2 ative act by an individual that— 3 (A) clearly and conspicuously commu- 4 nicates the individual’s authorization of an act 5 or practice; 6 (B) is made in the absence of any mecha- 7 nism in the user interface that has the purpose 8 or substantial effect of obscuring, subverting, or 9 impairing decision making or choice to obtain 10 consent; and 11 (C) cannot be inferred from inaction. 12 (2) COLLECT.—The term ‘‘collect’’, with re- 13 spect to emergency health data, means obtaining in 14 any manner by a covered organization. 15 (3) COMMISSION.—The term ‘‘Commission’’ 16 means the Federal Trade Commission. 17 (4) COVERED ORGANIZATION.— 18 (A) IN GENERAL.—The term ‘‘covered or- 19 ganization’’ means any person (including a gov- 20 ernment entity)— 21 (i) that collects, uses, or discloses 22 emergency health data electronically or 23 through communication by wire or radio; 24 or 25 VerDate Sep 11 2014 19:04 Feb 09, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S81.IS S81 pamtmann on DSKBC07HB2PROD with BILLS 3 •S 81 IS (ii) that develops or operates a 1 website, web application, mobile applica- 2 tion, mobile operating system feature, or 3 smart device application for the purpose of 4 tracking, screening, monitoring, contact 5 tracing, or mitigation, or otherwise re- 6 sponding to the COVID–19 public health 7 emergency. 8 (B) EXCLUSIONS.—The term ‘‘covered or- 9 ganization’’ does not include— 10 (i) a health care provider; 11 (ii) a person engaged in a de minimis 12 collection or processing of emergency 13 health data; 14 (iii) a service provider; 15 (iv) a person acting in their individual 16 or household capacity; or 17 (v) a public health authority. 18 (5) DEMOGRAPHIC DATA.—The term ‘‘demo- 19 graphic data’’ means information relating to the ac- 20 tual or perceived race, color, ethnicity, national ori- 21 gin, religion, sex, gender, gender identity, sexual ori- 22 entation, age, Tribal affiliation, disability, domicile, 23 employment status, familial status, immigration sta- 24 VerDate Sep 11 2014 19:04 Feb 09, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S81.IS S81 pamtmann on DSKBC07HB2PROD with BILLS 4 •S 81 IS tus, or veteran status of an individual or group of 1 individuals. 2 (6) DEVICE.—The term ‘‘device’’ means any 3 electronic equipment that is primarily designed for 4 or marketed to consumers. 5 (7) DISCLOSURE.—The term ‘‘disclosure’’, with 6 respect to emergency health data, means the releas- 7 ing, transferring, selling, providing access to, licens- 8 ing, or divulging in any manner by a covered organi- 9 zation to a third party. 10 (8) EMERGENCY HEALTH DATA.—The term 11 ‘‘emergency health data’’ means data linked or rea- 12 sonably linkable to an individual or device, including 13 data inferred or derived about the individual or de- 14 vice from other collected data provided such data is 15 still linked or reasonably linkable to the individual or 16 device, that concerns the public COVID–19 health 17 emergency. Such data includes— 18 (A) information that reveals the past, 19 present, or future physical or behavioral health 20 or condition of, or provision of healthcare to, an 21 individual, including— 22 (i) data derived from the testing or 23 examination of a body part or bodily sub- 24 stance, or a request for such testing; 25 VerDate Sep 11 2014 19:04 Feb 09, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S81.IS S81 pamtmann on DSKBC07HB2PROD with BILLS 5 •S 81 IS (ii) whether or not an individual has 1 contracted or been tested for, or an esti- 2 mate of the likelihood that a particular in- 3 dividual may contract, such disease or dis- 4 order; and 5 (iii) genetic data, biological samples, 6 and biometrics; and 7 (B) other data collected in conjunction 8 with other emergency health data or for the 9 purpose of tracking, screening, monitoring, con- 10 tact tracing, or mitigation, or otherwise re- 11 sponding to the COVID–19 public health emer- 12 gency, including— 13 (i) geolocation data, when such term 14 means data capable of determining the 15 past or present precise physical location of 16 an individual at a specific point in time, 17 taking account of population densities, in- 18 cluding cell-site location information, tri- 19 angulation data derived from nearby wire- 20 less or radio frequency networks, and glob- 21 al positioning system data; 22 (ii) proximity data, when such term 23 means information that identifies or esti- 24 mates the past or present physical prox- 25 VerDate Sep 11 2014 19:04 Feb 09, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S81.IS S81 pamtmann on DSKBC07HB2PROD with BILLS 6 •S 81 IS imity of one individual or device to an- 1 other, including information derived from 2 Bluetooth, audio signatures, nearby wire- 3 less networks, and near-field communica- 4 tions; 5 (iii) demographic data; 6 (iv) contact information for identifi- 7 able individuals or a history of the individ- 8 ual’s contacts over a period of time, such 9 as an address book or call log; and 10 (v) any other data collected from a 11 personal device. 12 (9) GOVERNMENT ENTITY.—The term ‘‘govern- 13 ment entity’’ includes a Federal agency, a State, a 14 local government, and other organizations, as such 15 terms are defined in section 3371 of title 5, United 16 States Code. 17 (10) HEALTH CARE PROVIDER.—The term 18 ‘‘health care provider’’ has the meaning given the 19 term ‘‘eligible health care provider’’ in title VIII of 20 division B of the CARES Act (Public Law 116– 21 136). 22 (11) HIPAA REGULATIONS.—The term 23 ‘‘HIPAA regulations’’ means parts 160 and 164 of 24 title 45, Code of Federal Regulations. 25 VerDate Sep 11 2014 19:04 Feb 09, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S81.IS S81 pamtmann on DSKBC07HB2PROD with BILLS 7 •S 81 IS (12) PUBLIC HEALTH AUTHORITY.—The term 1 ‘‘public health authority’’ means an entity that is 2 authorized by law to collect or receive information 3 for the purpose of preventing or controlling disease, 4 injury, or disability including, but not limited to, the 5 reporting of disease, injury, vital events such as 6 birth or death, and the conduct of public health sur- 7 veillance, public health investigations, and public 8 health interventions, and a person, such as a des- 9 ignated agency or associate, acting under a grant of 10 authority from, or under a contract with, such public 11 entity, including the employees or agents of such en- 12 tity or its contractors or persons or entities to whom 13 it has granted authority. 14 (13) COVID–19 PUBLIC HEALTH EMER- 15 GENCY.—The term ‘‘COVID–19 public health emer- 16 gency’’ means the outbreak and public health re- 17 sponse pertaining to Coronavirus Disease 2019 18 (COVID–19), associated with the emergency de- 19 clared by the Secretary on January 31, 2020, under 20 section 319 of the Public Health Service Act (42 21 U.S.C. 247d), and any renewals thereof and any 22 subsequent declarations by the Secretary related to 23 the coronavirus. 24 VerDate Sep 11 2014 19:04 Feb 09, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S81.IS S81 pamtmann on DSKBC07HB2PROD with BILLS 8 •S 81 IS (14) SECRETARY.—The term ‘‘Secretary’’ 1 means the Secretary of Health and Human Services. 2 (15) SERVICE PROVIDER.— 3 (A) IN GENERAL.—The term ‘‘service pro- 4 vider’’ means a person that collects, uses, or 5 discloses emergency health data for the sole 6 purpose of, and only to the extent that such en- 7 tity is, conducting business activities on behalf 8 of, for the benefit of, under instruction of, and 9 under contractual agreement with a covered or- 10 ganization. 11 (B) LIMITATION OF APPLICATION.—Such 12 person shall only be considered a service pro- 13 vider in the course of activities described in 14 subparagraph (A). 15 (C) EXCLUSIONS.—The term ‘‘service pro- 16 vider’’ excludes a person that develops or oper- 17 ates a website, web application, mobile applica- 18 tion, or smart device application for the purpose 19 of tracking, screening, monitoring, contact trac- 20 ing, or mitigation, or otherwise responding to 21 the COVID–19 public health emergency. 22 (16) STATE.—The term ‘‘State’’ means each 23 State of the United States, the District of Columbia, 24 each commonwealth, territory, or possession of the 25 VerDate Sep 11 2014 19:04 Feb 09, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S81.IS S81 pamtmann on DSKBC07HB2PROD with BILLS 9 •S 81 IS United States, and each federally recognized Indian 1 Tribe. 2 (17) THIRD PARTY.— 3 (A) IN GENERAL.—The term ‘‘third party’’ 4 means, with respect to a covered organization— 5 (i) another person to whom such cov- 6 ered organization disclosed emergency 7 health data; and 8 (ii) a corporate affiliate or a related 9 party of the covered organization that does 10 not have a direct relationship with an indi- 11 vidual with whom the emergency health 12 data is linked or is reasonably linkable. 13 (B) EXCLUSION.—The term ‘‘third party’’ 14 excludes, with respect to a covered organiza- 15 tion— 16 (i) a service provider of such covered 17 organization; or 18 (ii) a public health authority. 19 (18) USE.—The term ‘‘use’’, with respect to 20 emergency health data, means the processing, em- 21 ployment, application, utilization, examination, or 22 analysis of such data by a covered organization that 23 maintains such data. 24 VerDate Sep 11 2014 19:04 Feb 09, 2021 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S81.IS S81 pamtmann on DSKBC07HB2PROD with BILLS 10 •S 81 IS SEC. 3. PROTECTING THE PRIVACY AND SECURITY OF 1 EMERGENCY HEALTH DATA. 2 (a) RIGHT TO PRIVACY.—A covered organization that 3 collects emergency health data shall— 4 (1) only collect, use, or disclose such data that 5 is necessary, proportionate, and limited for a good 6 faith public health purpose, including a service or 7 feature to support such a purpose; 8 (2) take reasonable measures, where possible, to 9 ensure the accuracy of emergency health data and 10 provide an effective mechanism for an individual to 11 correct inaccurate information; 12 (3) adopt reasonable safeguards to prevent un- 13 lawful discrimination on the basis of emergency 14 health data; and 15 (4) only disclose such data to a government en- 16 tity when the disclosure— 17 (A) is to a public health authority; and 18 (B) is made in solely for good faith public 19 health purposes and in direct response to exi- 20 gent circumstances. 21 (b) RIGHT TO SECURITY.—A covered organization or 22 service provider that collects, uses, or discloses emergency 23 health data shall establish and implement reasonable data 24 security policies, practices, and procedures to protect the 25 security and confidentiality of emergency health data. 26 VerDate Sep 11 2014 19:04 Feb 09, 2021 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S81.IS S81 pamtmann on DSKBC07HB2PROD with BILLS 11 •S 81 IS (c) PROHIBITED USES.—A covered organization shall 1 not collect, use, or disclose emergency health data for any 2 purpose not authorized under this section, including— 3 (1) commercial advertising, recommendation for 4 e-commerce, or the training of machine-learning al- 5 gorithms related to, or subsequently for use in, com- 6 mercial advertising and e-commerce; 7 (2) soliciting, offering, selling, leasing, licensing, 8 renting, advertising, marketing, or otherwise com- 9 mercially contracting for employment, finance, cred- 10 it, insurance, housing, or education opportunities in 11 a manner that discriminates or otherwise makes op- 12 portunities unavailable on the basis of emergency 13 health data; and 14 (3) segregating, discriminating in, or otherwise 15 making unavailable the goods, services, facilities, 16 privileges, advantages, or accommodations of any 17 place of public accommodation (as such term is de- 18 fined in section 301 of the Americans With Disabil- 19 ities Act of 1990 (42 U.S.C. 12181)), except as au- 20 thorized by a State or Federal Government entity 21 for a public health purpose notwithstanding sub- 22 section (g). 23 (d) CONSENT.— 24 VerDate Sep 11 2014 19:04 Feb 09, 2021 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S81.IS S81 pamtmann on DSKBC07HB2PROD with BILLS 12 •S 81 IS (1) IN GENERAL.—It shall be unlawful for a 1 covered organization to collect, use, or disclose emer- 2 gency health data, unless— 3 (A) the individual to whom the data per- 4 tains has given affirmative express consent to 5 such collection, use, or disclosure; 6 (B) such collection, use, or disclosure is 7 necessary and for the sole purpose of— 8 (i) protecting against malicious, de- 9 ceptive, fraudulent, or illegal activity; or 10 (ii) detecting, responding to, or pre- 11 venting information security incidents or 12 threats; or 13 (C) the covered organization is compelled 14 to do so by a legal obligation. 15 (2) REVOCATION.— 16 (A) IN GENERAL.—A covered organization 17 shall provide an effective mechanism for an in- 18 dividual to revoke consent after it is given. 19 (B) EFFECT.—After an individual revokes 20 consent, the covered organization shall cease 21 collecting, using, or disclosing the individual’s 22 emergency health data as soon as practicable, 23 but in no case later than 15 days after the re- 24 ceipt of the individual’s revocation of consent. 25 VerDate Sep 11 2014 19:04 Feb 09, 2021 Jkt 019200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S81.IS S81 pamtmann on DSKBC07HB2PROD with BILLS 13 •S 81 IS (C) DESTRUCTION.—Not later than 30 1 days after the receipt of an individual’s revoca- 2 tion of consent, a covered organization shall de- 3 str [Text truncated for display. Full text available on Congress.gov.]