Protecting Personal Health Data Act

II 116TH CONGRESS 1ST SESSION S. 1842 To protect the personal health data of all Americans. IN THE SENATE OF THE UNITED STATES JUNE 13, 2019 Ms. KLOBUCHAR (for herself and Ms. MURKOWSKI) introduced the following bill; which was read twice and referred to the Committee on Health, Edu- cation, Labor, and Pensions A BILL To protect the personal health data of all Americans. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Protecting Personal 4 Health Data Act’’. 5 SEC. 2. FINDINGS. 6 Congress finds as follows: 7 (1) On July 19, 2016, the Department of 8 Health and Human Services, acting through the Of- 9 fice of the National Coordinator for Health Informa- 10 tion Technology and in coordination with the Office 11 VerDate Sep 11 2014 02:48 Jun 19, 2019 Jkt 034408 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1842.IS S1842 pbinns on DSK79D2C42PROD with BILLS 2 •S 1842 IS for Civil Rights of the Department of Health and 1 Human Services and the Federal Trade Commission, 2 issued a report to Congress entitled ‘‘Examining 3 Oversight of the Privacy & Security of Health Data 4 Collected by Entities Not Regulated by HIPAA’’ (re- 5 ferred to in this section as the ‘‘report’’) about the 6 need to enact modern protections for consumers’ 7 personal health data. 8 (2) The report states that ‘‘[t]he wearable fit- 9 ness trackers, social media sites where individuals 10 share health information through specific social net- 11 works, and other technologies that are common 12 today did not exist when Congress enacted the 13 Health Insurance Portability and Accountability Act 14 of 1996’’. 15 (3) The report states that entities not covered 16 by the privacy protections of the Health Insurance 17 Portability and Accountability Act of 1996 (Public 18 Law 104–191), such as wearable fitness trackers 19 and health-focused social media sites, ‘‘engage in a 20 variety of practices such as online advertising and 21 marketing, commercial uses or sale of individual in- 22 formation, and behavioral tracking practices, all of 23 which indicate information use that is likely broader 24 than what individuals would anticipate’’. 25 VerDate Sep 11 2014 02:48 Jun 19, 2019 Jkt 034408 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1842.IS S1842 pbinns on DSK79D2C42PROD with BILLS 3 •S 1842 IS (4) The report ‘‘identifies key gaps that exist 1 between HIPAA regulated entities and those not 2 regulated by HIPAA’’ and ‘‘recommends addressing 3 those gaps in a way that protects consumers while 4 leveling the playing field for innovators inside and 5 outside of HIPAA’’. 6 SEC. 3. DEFINITIONS. 7 In this Act: 8 (1) CONSUMER DEVICES, SERVICES, APPLICA- 9 TIONS, AND SOFTWARE.— 10 (A) IN GENERAL.—Except as provided in 11 subparagraph (C), the term ‘‘consumer devices, 12 services, applications, and software’’ means de- 13 vices, services, applications, and software— 14 (i) that are primarily designed for or 15 marketed to consumers; and 16 (ii) a substantial purpose or use of 17 which is to collect or use personal health 18 data. 19 (B) INCLUSION.—The term ‘‘consumer de- 20 vices, services, applications, and software’’ shall 21 include, but is not limited to— 22 (i) direct-to-consumer genetic testing 23 services; 24 VerDate Sep 11 2014 02:48 Jun 19, 2019 Jkt 034408 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S1842.IS S1842 pbinns on DSK79D2C42PROD with BILLS 4 •S 1842 IS (ii) cloud-based or mobile technologies 1 that are designed to collect individuals’ 2 personal health data directly or indirectly 3 with individuals’ consent, which could en- 4 able sharing of such information, such as 5 wearable fitness trackers; and 6 (iii) internet-based social media sites 7 which are primarily designed for, or mar- 8 keted to, consumers to collect or use per- 9 sonal health data, including sites that 10 share health conditions and experiences. 11 (C) EXCEPTION.—The term ‘‘consumer de- 12 vices, services, applications, and software’’ shall 13 not include— 14 (i) products on which personal health 15 data is derived solely from other informa- 16 tion that is not personal health data, such 17 as Global Positioning System data; or 18 (ii) products primarily designed for, or 19 marketed to, covered entities and business 20 associates (as defined for purposes of regu- 21 lations promulgated under section 264(c) 22 of the Health Insurance Portability and 23 Accountability Act of 1996 (42 U.S.C. 24 1320d–2 note)). 25 VerDate Sep 11 2014 02:48 Jun 19, 2019 Jkt 034408 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S1842.IS S1842 pbinns on DSK79D2C42PROD with BILLS 5 •S 1842 IS (2) DIRECT-TO-CONSUMER GENETIC TESTING 1 SERVICES.—The term ‘‘direct-to-consumer genetic 2 testing service’’ means a service, which may include 3 a test that analyzes various aspects of an individ- 4 ual’s genetic material, that enables a consumer to 5 have access to their genetic information, or to infor- 6 mation derived therefrom, without the need to have 7 a health care provider or health insurance issuer 8 participate in the process of gaining access. 9 (3) NATIONAL COORDINATOR.—The term ‘‘Na- 10 tional Coordinator’’ means the National Coordinator 11 for Health Information Technology at the Depart- 12 ment of Health and Human Services. 13 (4) OPERATOR.—The term ‘‘operator’’ means 14 any person who operates any type of consumer de- 15 vices, services, applications, and software or who 16 provides consumer devices, services, applications, 17 and software for the use of consumers and collects 18 or maintains personal health data from or about the 19 users of such consumer devices, services, applica- 20 tions, and software. 21 (5) PERSONAL HEALTH DATA.—The term ‘‘per- 22 sonal health data’’ means any information, including 23 genetic information, whether oral or recorded in any 24 form or medium, that relates to the past, present, or 25 VerDate Sep 11 2014 02:48 Jun 19, 2019 Jkt 034408 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S1842.IS S1842 pbinns on DSK79D2C42PROD with BILLS 6 •S 1842 IS future physical or mental health or condition of an 1 individual and that identifies the individual or with 2 respect to which there is a reasonable basis to be- 3 lieve that the information can be used to identify the 4 individual. 5 (6) SECRETARY.—The term ‘‘Secretary’’ means 6 the Secretary of Health and Human Services. 7 SEC. 4. PROMULGATION OF REGULATIONS FOR OPERA- 8 TORS OF CONSUMER DEVICES, SERVICES, AP- 9 PLICATIONS, AND SOFTWARE. 10 (a) IN GENERAL.—Not later than 6 months after the 11 date on which the report is submitted under section 5(d), 12 the Secretary, in consultation with the Chairman of the 13 Federal Trade Commission, the National Coordinator, rel- 14 evant stakeholders, and heads of such other Federal agen- 15 cies as the Secretary considers appropriate, shall promul- 16 gate regulations to help strengthen privacy and security 17 protections for consumers’ personal health data that is col- 18 lected, processed, analyzed, or used by consumer devices, 19 services, applications, and software. 20 (b) REQUIREMENTS.— 21 (1) IN GENERAL.—The Secretary shall ensure 22 that the regulations pursuant to subsection (a)— 23 (A) account for differences in the nature 24 and sensitivity of the data collected or stored on 25 VerDate Sep 11 2014 02:48 Jun 19, 2019 Jkt 034408 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S1842.IS S1842 pbinns on DSK79D2C42PROD with BILLS 7 •S 1842 IS the consumer device, service, application, or 1 software; and 2 (B) include such definitions for relevant 3 terms that are necessary to accomplish the 4 goals of the regulations set forth in subsection 5 (a). 6 (2) REQUIREMENTS OF SECRETARY.—In the 7 promulgation of regulations under subsection (a), 8 the Secretary, to the extent practicable, shall— 9 (A) consider the findings in the report 10 issued by the Department of Health and 11 Human Services to Congress entitled ‘‘Exam- 12 ining Oversight of the Privacy & Security of 13 Health Data Collected by Entities Not Regu- 14 lated by HIPAA’’, including findings regarding 15 individuals’ access rights, re-use of data by 16 third parties, security standards applicable to 17 data holders and users, confusion or ambiguity 18 regarding terminology related to privacy and se- 19 curity protections, and the adequacy of collec- 20 tion, use, and disclosure limitations; 21 (B) consider other regulations and guid- 22 ance issued by the Federal Trade Commission, 23 and other regulations promulgated under sec- 24 tion 264(c) of the Health Insurance Portability 25 VerDate Sep 11 2014 02:48 Jun 19, 2019 Jkt 034408 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S1842.IS S1842 pbinns on DSK79D2C42PROD with BILLS 8 •S 1842 IS and Accountability Act of 1996 (42 U.S.C. 1 1320d–2 note), subtitle D of the Health Infor- 2 mation Technology for Economic and Clinical 3 Health Act (42 U.S.C. 17921 et seq.), Genetic 4 Information Nondiscrimination Act (Public Law 5 110–233, 122 Stat. 881), the Common Rule as 6 contained in part 46 of title 45, Code of Fed- 7 eral Regulations, and other related Acts; 8 (C) consistent with paragraph (3), consider 9 appropriate uniform standards for consent re- 10 lated to the handling of genetic data, biometric 11 data, and personal health data; 12 (D) consider exceptions to consent require- 13 ments under subparagraph (C) for purposes 14 that may include law enforcement, academic re- 15 search or research for the sole purpose of as- 16 sessing health care utilization and outcomes, 17 emergency medical treatment, or determining 18 paternity; 19 (E) consider appropriate minimum stand- 20 ards of security that may differ according to 21 the nature and sensitivity of the data collected 22 or stored on, or processed or transferred by, the 23 consumer device, service, application, or soft- 24 ware; 25 VerDate Sep 11 2014 02:48 Jun 19, 2019 Jkt 034408 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S1842.IS S1842 pbinns on DSK79D2C42PROD with BILLS 9 •S 1842 IS (F) consider appropriate standards for the 1 de-identification of personal health data; 2 (G) consider appropriate limitations on the 3 collection, use, or disclosure of personal health 4 data to that which is directly relevant and nec- 5 essary to accomplish a specified purpose; 6 (H) consult with the National Coordinator, 7 the Commissioner of Food and Drugs, and the 8 Chairman of the Federal Trade Commission; 9 and 10 (I) provide for initial and ongoing outreach 11 regarding regulations affecting industries, busi- 12 nesses, and individuals to ensure awareness of 13 consumer privacy and security protections in 14 the field of digital health technology. 15 (3) UNIFORM STANDARDS.—In the review of 16 each of the areas described in paragraph (2)(C), the 17 Secretary shall consider— 18 (A) the development of standards for ob- 19 taining user consent based on how information 20 will be shared to ensure that prior to the collec- 21 tion, analysis, use, or disclosure of consumers’ 22 personal health data, an operator of a consumer 23 device, service, application, or software specifies 24 VerDate Sep 11 2014 02:48 Jun 19, 2019 Jkt 034408 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S1842.IS S1842 pbinns on DSK79D2C42PROD with BILLS 10 •S 1842 IS the uses of the personal health data and who 1 will have access to the information; 2 (B) the manner in which consent is ob- 3 tained in a way that uses clear, concise, and 4 well-organized language that is easily accessible, 5 of reasonable length, at an appropriate level of 6 readability, and clearly distinguishable from 7 other matters; 8 (C) a process to limit the transfer of per- 9 sonal health data to third parties and provide 10 consumers with greater control over how their 11 personal health data is used for marketing pur- 12 poses; 13 (D) secondary uses outside of the primary 14 purpose of the service as initially indicated 15 when consent was first obtained; 16 (E) a process to permit a withdrawal of 17 consent to ensure that a user is able to remove 18 consent for the terms of service for use of the 19 consumer device, service, application, or soft- 20 ware, including the collection and use of per- 21 sonal health data as easily as the user is able 22 to give such consent; 23 (F) providing a right to access a copy of 24 the personal health data that the operator has 25 VerDate Sep 11 2014 02:48 Jun 19, 2019 Jkt 034408 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S1842.IS S1842 pbinns on DSK79D2C42PROD with BILLS 11 •S 1842 IS collected, analyzed, or used, free of charge and 1 in an electronic and easily accessible format, in- 2 cluding a list of each entity that received the 3 personal health data from the operator, whether 4 through sale or other means; and 5 (G) providing a right to delete and amend 6 personal health data, to the extent practicable, 7 that the operator has collected, analyzed, or 8 used. 9 (c) UPDATES.—The Secretary shall review and, if 10 necessary, update the regulations promulgated under sub- 11 section (a) in accordance with the requirements under sub- 12 section (b). 13 (d) PUBLIC AVAILABILITY.—The Department of 14 Health and Human Services shall make prominently avail- 15 able to the public on the Department’s internet website, 16 clear and concise information about available resources re- 17 lated to the regulations promulgated under subsection (a) 18 and all updates to such resources. 19 (e) CONSISTENCY OF RESOURCES PUBLISHED BY 20 FEDERAL AGENCIES.—If a Federal agency publishes re- 21 sources to help protect consumers’ personal health data, 22 the head of such Federal agency, to the degree practicable, 23 shall make such resources consistent with the regulations 24 promulgated under subsection (a). 25 VerDate Sep 11 2014 02:48 Jun 19, 2019 Jkt 034408 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S1842.IS S1842 pbinns on DSK79D2C42PROD with BILLS 12 •S 1842 IS (f) OTHER FEDERAL PRIVACY AND SECURITY RE- 1 QUIREMENTS.—Nothing in this section shall be construed 2 to supersede, alter, or otherwise affect any privacy and 3 security requirements enforced by Federal agencies. 4 SEC. 5. NATIONAL TASK FORCE ON HEALTH DATA PROTEC- 5 TION. 6 (a) ESTABLISHMENT.—The Secretary, in consulta- 7 tion with the Chairman of the Federal Trade Commission, 8 the National Coordinator, and relevant stakeholders, shall 9 establish a task force, to be known as the National Task 10 Force on Health Data Protection (referred to in this sec- 11 tion as the ‘‘Task Force’’). 12 (b) DUTIES.—The Task Force shall— 13 (1) study the long-term effectiveness of de-iden- 14 tification methodologies for genetic data and biomet- 15 r [Text truncated for display. Full text available on Congress.gov.]