Secure Data and Privacy for Contact Tracing Act of 2021

II 117TH CONGRESS 1ST SESSION S. 199 To authorize the Director of the Centers for Disease Control and Prevention to award grants to eligible State, Tribal, and territorial public health agencies to develop and administer a program for digital contact tracing for COVID–19, and for other purposes. IN THE SENATE OF THE UNITED STATES FEBRUARY 3, 2021 Mr. SCHATZ (for himself and Ms. BALDWIN) introduced the following bill; which was read twice and referred to the Committee on Health, Edu- cation, Labor, and Pensions A BILL To authorize the Director of the Centers for Disease Control and Prevention to award grants to eligible State, Tribal, and territorial public health agencies to develop and ad- minister a program for digital contact tracing for COVID–19, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Secure Data and Pri- 4 vacy for Contact Tracing Act of 2021’’. 5 VerDate Sep 11 2014 05:28 Feb 17, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S199.IS S199 kjohnson on DSK79L0C42PROD with BILLS 2 •S 199 IS SEC. 2. GRANT PROGRAM FOR DIGITAL CONTACT TRACING 1 FOR COVID–19. 2 (a) IN GENERAL.—The Director of the Centers for 3 Disease Control and Prevention shall award grants to eli- 4 gible State, Tribal, and territorial public health agencies 5 to— 6 (1) establish a contact-tracing program that im- 7 plements traditional contact-tracing protocols with 8 the assistance of digital contact-tracing technology 9 to track and prevent the spread of COVID–19; 10 (2) incorporate digital contact-tracing tech- 11 nology into a contact-tracing program that imple- 12 ments traditional contact-tracing protocols to track 13 and prevent the spread of COVID–19; and 14 (3) expand or maintain an existing program as 15 described in subparagraph (1). 16 (b) USE OF FUNDS.— 17 (1) IN GENERAL.—Funds received through a 18 grant under this section, may be used for— 19 (A) the development, maintenance, or 20 staffing of digital contact-tracing programs; 21 (B) associated outreach and marketing; or 22 (C) other activities identified by a State, 23 Tribal, or territorial public health agency as ad- 24 vancing the effectiveness and reach of digital 25 contact-tracing technologies. 26 VerDate Sep 11 2014 05:28 Feb 17, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S199.IS S199 kjohnson on DSK79L0C42PROD with BILLS 3 •S 199 IS (2) EDUCATION AND OUTREACH.—Of the funds 1 received by a State, Tribal, or territorial public 2 health agency through a grant under this section, 3 the agency may use not more than 10 percent of 4 such funds to integrate education and outreach re- 5 lated to vaccines for COVID–19 into digital contact- 6 tracing programs. 7 (c) FUNDING DISQUALIFICATION.—If a State, Trib- 8 al, or territorial public health agency develops or procures 9 any digital contact-tracing technology with respect to 10 COVID–19 that does not meet each of the requirements 11 listed in subsection (d), such State, Tribal, or territorial 12 public health agency shall be ineligible to receive or con- 13 tinue to receive— 14 (1) any funds through a grant under this sec- 15 tion; and 16 (2) any other Federal funds, including under 17 the CARES Act (Public Law 116–136), for any dig- 18 ital contact-tracing technology with respect to 19 COVID–19. 20 (d) DIGITAL CONTACT-TRACING REQUIREMENTS.— 21 A State, Tribal, or territorial public health agency may 22 use a grant under this section for digital contact-tracing 23 technology, as described in subsections (a) and (b), only 24 if the technology meets each of the following requirements: 25 VerDate Sep 11 2014 05:28 Feb 17, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S199.IS S199 kjohnson on DSK79L0C42PROD with BILLS 4 •S 199 IS (1) The technology shall be voluntary for the 1 user and provide to the user complete and clear in- 2 formation on the intended use and processing of 3 data collected by the technology. To be voluntary for 4 the user, the technology shall meet requirements in- 5 cluding each of the following: 6 (A) Use of the technology and of contact- 7 tracing data collected using the technology shall 8 be predicated on the user’s affirmative consent. 9 (B) Use of the technology shall not be a 10 condition for the reception of government bene- 11 fits. 12 (C) Use of the technology shall not be 13 made a condition of employment or employment 14 status. 15 (2) The technology shall limit the collection of 16 data by the technology to only the data that is nec- 17 essary to meet contact-tracing objectives, includ- 18 ing— 19 (A) the status of any person as an infected 20 or potentially infected person; and 21 (B) the proximity of a person to someone 22 who is symptomatic or has tested positive. 23 (3) The technology— 24 VerDate Sep 11 2014 05:28 Feb 17, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S199.IS S199 kjohnson on DSK79L0C42PROD with BILLS 5 •S 199 IS (A) shall delete or de-identify any contact- 1 tracing data that is individually identifiable in- 2 formation not later than the date that is 30 3 days after the end of the COVID–19 emergency 4 declaration; and 5 (B) shall include notifications to prompt 6 users to disable or completely remove any dig- 7 ital contact-tracing technology where practical. 8 (4) The technology shall have robust contact 9 detection specifications, including for distance and 10 time, that allow for detection consistent with guid- 11 ance of the Centers for Disease Control and Preven- 12 tion on COVID–19. 13 (5) The technology shall ensure that the storing 14 of proximity and any contact-tracing data is 15 encrypted to the maximum extent possible. 16 (e) PLAN FOR INTEROPERABILITY.—As a condition 17 on receipt of a grant under this section, a State, Tribal, 18 or territorial public health agency shall— 19 (1) develop and make publicly available a plan 20 for how the digital contact-tracing technology of the 21 agency with respect to COVID–19 augments— 22 (A) traditional contact-tracing efforts, if 23 applicable; and 24 VerDate Sep 11 2014 05:28 Feb 17, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S199.IS S199 kjohnson on DSK79L0C42PROD with BILLS 6 •S 199 IS (B) statewide efforts to prevent, prepare 1 for, and respond to COVID–19; and 2 (2) include in such plan a description of the 3 agency’s efforts to ensure that the digital contact- 4 tracing technologies of the agency with respect to 5 COVID–19 are interoperable with the digital con- 6 tact-tracing technology and public health agency 7 databases of other jurisdictions with respect to 8 COVID–19; and 9 (3) ensure that data collected by the digital 10 contact-tracing technology of the agency— 11 (A) is accessed and processed only by pub- 12 lic health authorities (or their designees); and 13 (B) is not shared with any person, or 14 accessed or used by any person, for any purpose 15 other than diagnosis, containment, treatment, 16 or reduction of, or research into, COVID–19. 17 (f) INDEPENDENT SECURITY ASSESSMENTS.— 18 (1) IN GENERAL.—As a condition on receipt of 19 a grant under this section, a State, Tribal, or terri- 20 torial public health agency shall— 21 (A) establish procedures for completing or 22 obtaining independent security assessments of 23 digital contact-tracing infrastructure to ensure 24 VerDate Sep 11 2014 05:28 Feb 17, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S199.IS S199 kjohnson on DSK79L0C42PROD with BILLS 7 •S 199 IS that physical and network security is resilient 1 and secure; and 2 (B) develop a process to address the miti- 3 gation or remediation of the security 4 vulnerabilities discovered during such inde- 5 pendent security assessments. 6 (2) SOURCE CODE.—A State, Tribal, or terri- 7 torial public health agency should consider making 8 public the source code of the digital contact-tracing 9 technology used by the agency. 10 (g) APPLICATION.—To seek a grant under this sec- 11 tion, an eligible State, Tribal, or territorial public health 12 agency shall submit an application in such form, in such 13 manner, and containing such information and assurances 14 as the Director may require. 15 (h) SECURING DIGITAL CONTACT-TRACING DATA.— 16 (1) IN GENERAL.—The provisions of the 17 HIPAA privacy and security law (as defined in sec- 18 tion 3009(a)(2) of the Public Health Service Act (42 19 U.S.C. 300jj–19(a)(2))) shall apply to a State, Trib- 20 al, or territorial public health agency receiving a 21 grant under subsection (a) with respect to individ- 22 ually identifiable health information (as defined in 23 section 1171(a)(6) of the Social Security Act (42 24 U.S.C. 1320d(a)(6))) received by, maintained on, or 25 VerDate Sep 11 2014 05:28 Feb 17, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S199.IS S199 kjohnson on DSK79L0C42PROD with BILLS 8 •S 199 IS transmitted through a contact-tracing program de- 1 scribed in such subsection (a) in the same manner 2 as such provisions apply with respect to such infor- 3 mation and a covered entity (as defined in section 4 13400(3) of the HITECH Act (42 U.S.C. 5 17921(3))). 6 (2) BUSINESS ASSOCIATES.— 7 (A) IN GENERAL.—Any entity with a con- 8 tract in effect with an agency described in para- 9 graph (1) for the development, maintenance, or 10 operation of a program described in such para- 11 graph shall be deemed to be a business asso- 12 ciate of such agency for purposes of subtitle D 13 of the HITECH Act (42 U.S.C. 17921 et seq.). 14 (B) REVISION OF SAMPLE AGREEMENT.— 15 Not later than 180 days after the date of the 16 enactment of this Act, the Secretary shall revise 17 the sample business associate agreement provi- 18 sions published on January 25, 2013, to take 19 account of the provisions of this subsection. 20 (C) EFFECTIVE DATE.—The provisions of 21 subparagraph (A) shall apply beginning on the 22 day after the Secretary revises the provisions 23 described in subparagraph (B). 24 VerDate Sep 11 2014 05:28 Feb 17, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S199.IS S199 kjohnson on DSK79L0C42PROD with BILLS 9 •S 199 IS (i) LIMITATION ON USE OF DATA.—Data generated 1 in connection with the operation of digital contact-tracing 2 technology funded pursuant to this section may not be 3 used for any punitive purpose, including law enforcement, 4 immigration enforcement, or criminal prosecution. Such 5 data and any information derived from it, whether in 6 whole or in part, may not be received as evidence in any 7 trial, hearing, or other proceeding in or before any court, 8 grand jury, department, officer, agency, regulatory body, 9 legislative committee, or other authority of the United 10 States, a State, or a political subdivision thereof. 11 (j) REPORT TO CONGRESS.—Not later than 24 12 months after the date of enactment of this Act, the Comp- 13 troller General of the United States shall— 14 (1) evaluate the outcome of the grants awarded 15 under this section, including an assessment of the 16 impact of the implementation of digital contact-trac- 17 ing programs funded through such grants on the 18 spread of COVID–19; and 19 (2) submit to the Congress a report on the re- 20 sults of such evaluation. 21 (k) DEFINITIONS.—In this section: 22 (1) AFFIRMATIVE EXPRESS CONSENT.—The 23 term ‘‘affirmative express consent’’ means an affirm- 24 ative act by an individual that clearly and conspicu- 25 VerDate Sep 11 2014 05:28 Feb 17, 2021 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S199.IS S199 kjohnson on DSK79L0C42PROD with BILLS 10 •S 199 IS ously communicates the individual’s authorization 1 for an act or practice, in response to a specific re- 2 quest that— 3 (A) is provided to the individual in a clear 4 and conspicuous disclosure that is separate 5 from other options or acceptance of general 6 terms; 7 (B) includes a description of each act or 8 practice for which the individual’s consent is 9 sought and— 10 (i) is written clearly and unmistakably 11 stated; and 12 (ii) includes a prominent heading that 13 would enable a reasonable individual to 14 identify and understand the act or prac- 15 tice; and 16 (C) cannot be inferred from inaction. 17 (2) CONTACT-TRACING DATA.—The term ‘‘con- 18 tact-tracing data’’ means information linked or rea- 19 sonably linkable to a user or device, that— 20 (A) concerns the COVID–19 pandemic; 21 and 22 (B) is gathered, processed, or transferred 23 by digital contact-tracing technology. 24 VerDate Sep 11 2014 05:28 Feb 17, 2021 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S199.IS S199 kjohnson on DSK79L0C42PROD with BILLS 11 •S 199 IS (3) COVID–19 EMERGENCY DECLARATION.— 1 The term ‘‘COVID–19 emergency declaration’’ has 2 the meaning given to such term in section 3 1135(g)(1)(B) of the Social Security Act (42 U.S.C. 4 1320b–5). 5 (4) DE-IDENTIFY.—The term ‘‘de-identify’’ 6 means to ensure that information cannot reasonably 7 identify, relate to, describe, be capable of being asso- 8 ciated with, or be linked, directly or indirectly, to a 9 particular individual. 10 (5) DESIGNEE.—The term ‘‘designee’’— 11 (A) subject to subparagraph (B), means 12 any person or entity, other than a public health 13 agency, that collects, processes, or transfers 14 contact-tracing data in the course of performing 15 a service or function on behalf of, for the ben- 16 efit of, under instruction of, and under contrac- 17 tual agreement with a public health authority; 18 and 19 (B) excludes any Federal, State, Tribal, 20 territorial, or local law (including immigration 21 law) enforcement personnel or entity. 22 (6) DIGITAL CONTACT-TRACING TECH- 23 NOLOGY.— 24 VerDate Sep 11 2014 05:28 Feb 17, 2021 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S199.IS S199 kjohnson on DSK79L0C42PROD with BILLS 12 •S 199 IS (A) IN GENERAL.—The term ‘‘digital con- 1 tact-tracing technology’’ means a website, on- 2 line application, mobile application, mobile oper- 3 ating system feature, or smart device applica- 4 tion that is designed, in part or in full, for the 5 purpose of— 6 (i) determining that a contact incident 7 has occurred relating to the COVID–19 8 pandemic; and 9 (ii) taking consequent steps such as 10 reporting the incident to a public health 11 authority or user, or providing guidance or 12 instructions to the user of the mobile de- 13 vice or the user’s household. 14 (B) LIMITATIONS.—Such term does not in- 15 clude any technology to assist individuals to 16 evaluate whether they are experiencing COVID– 17 19 symptoms to the extent the technology is not 18 used as described in sub [Text truncated for display. Full text available on Congress.gov.]