Public Health Emergency Privacy Act

II 116TH CONGRESS 2D SESSION S. 3749 To protect the privacy of health information during a national health emergency. IN THE SENATE OF THE UNITED STATES MAY 14, 2020 Mr. BLUMENTHAL (for himself and Mr. WARNER) introduced the following bill; which was read twice and referred to the Committee on Health, Edu- cation, Labor, and Pensions A BILL To protect the privacy of health information during a national health emergency. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Public Health Emer- 4 gency Privacy Act’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 (1) AFFIRMATIVE EXPRESS CONSENT.—The 8 term ‘‘affirmative express consent’’ means an affirm- 9 ative act by an individual that— 10 VerDate Sep 11 2014 16:00 Jun 03, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S3749.IS S3749 pamtmann on DSKBC07HB2PROD with BILLS 2 •S 3749 IS (A) clearly and conspicuously commu- 1 nicates the individual’s authorization of an act 2 or practice; 3 (B) is made in the absence of any mecha- 4 nism in the user interface that has the purpose 5 or substantial effect of obscuring, subverting, or 6 impairing decision making or choice to obtain 7 consent; and 8 (C) cannot be inferred from inaction. 9 (2) COLLECT.—The term ‘‘collect’’, with re- 10 spect to emergency health data, means obtaining in 11 any manner by a covered organization. 12 (3) COMMISSION.—The term ‘‘Commission’’ 13 means the Federal Trade Commission. 14 (4) COVERED ORGANIZATION.— 15 (A) IN GENERAL.—The term ‘‘covered or- 16 ganization’’ means any person (including a gov- 17 ernment entity)— 18 (i) that collects, uses, or discloses 19 emergency health data electronically or 20 through communication by wire or radio; 21 or 22 (ii) that develops or operates a 23 website, web application, mobile applica- 24 tion, mobile operating system feature, or 25 VerDate Sep 11 2014 16:00 Jun 03, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S3749.IS S3749 pamtmann on DSKBC07HB2PROD with BILLS 3 •S 3749 IS smart device application for the purpose of 1 tracking, screening, monitoring, contact 2 tracing, or mitigation, or otherwise re- 3 sponding to the COVID–19 public health 4 emergency. 5 (B) EXCLUSIONS.—The term ‘‘covered or- 6 ganization’’ does not include— 7 (i) a health care provider; 8 (ii) a person engaged in a de minimis 9 collection or processing of emergency 10 health data; 11 (iii) a service provider; 12 (iv) a person acting in their individual 13 or household capacity; or 14 (v) a public health authority. 15 (5) DEMOGRAPHIC DATA.—The term ‘‘demo- 16 graphic data’’ means information relating to the ac- 17 tual or perceived race, color, ethnicity, national ori- 18 gin, religion, sex, gender, gender identity, sexual ori- 19 entation, age, Tribal affiliation, disability, domicile, 20 employment status, familial status, immigration sta- 21 tus, or veteran status of an individual or group of 22 individuals. 23 VerDate Sep 11 2014 16:00 Jun 03, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S3749.IS S3749 pamtmann on DSKBC07HB2PROD with BILLS 4 •S 3749 IS (6) DEVICE.—The term ‘‘device’’ means any 1 electronic equipment that is primarily designed for 2 or marketed to consumers. 3 (7) DISCLOSURE.—The term ‘‘disclosure’’, with 4 respect to emergency health data, means the releas- 5 ing, transferring, selling, providing access to, licens- 6 ing, or divulging in any manner by a covered organi- 7 zation to a third party. 8 (8) EMERGENCY HEALTH DATA.—The term 9 ‘‘emergency health data’’ means data linked or rea- 10 sonably linkable to an individual or device, including 11 data inferred or derived about the individual or de- 12 vice from other collected data provided such data is 13 still linked or reasonably linkable to the individual or 14 device, that concerns the public COVID–19 health 15 emergency. Such data includes— 16 (A) information that reveals the past, 17 present, or future physical or behavioral health 18 or condition of, or provision of healthcare to, an 19 individual, including— 20 (i) data derived from the testing or 21 examination of a body part or bodily sub- 22 stance, or a request for such testing; 23 (ii) whether or not an individual has 24 contracted or been tested for, or an esti- 25 VerDate Sep 11 2014 16:00 Jun 03, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S3749.IS S3749 pamtmann on DSKBC07HB2PROD with BILLS 5 •S 3749 IS mate of the likelihood that a particular in- 1 dividual may contract, such disease or dis- 2 order; and 3 (iii) genetic data, biological samples, 4 and biometrics; and 5 (B) other data collected in conjunction 6 with other emergency health data or for the 7 purpose of tracking, screening, monitoring, con- 8 tact tracing, or mitigation, or otherwise re- 9 sponding to the COVID–19 public health emer- 10 gency, including— 11 (i) geolocation data, when such term 12 means data capable of determining the 13 past or present precise physical location of 14 an individual at a specific point in time, 15 taking account of population densities, in- 16 cluding cell-site location information, tri- 17 angulation data derived from nearby wire- 18 less or radio frequency networks, and glob- 19 al positioning system data; 20 (ii) proximity data, when such term 21 means information that identifies or esti- 22 mates the past or present physical prox- 23 imity of one individual or device to an- 24 other, including information derived from 25 VerDate Sep 11 2014 16:00 Jun 03, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S3749.IS S3749 pamtmann on DSKBC07HB2PROD with BILLS 6 •S 3749 IS Bluetooth, audio signatures, nearby wire- 1 less networks, and near-field communica- 2 tions; 3 (iii) demographic data; 4 (iv) contact information for identifi- 5 able individuals or a history of the individ- 6 ual’s contacts over a period of time, such 7 as an address book or call log; and 8 (v) any other data collected from a 9 personal device. 10 (9) GOVERNMENT ENTITY.—The term ‘‘govern- 11 ment entity’’ includes a Federal agency, a State, a 12 local government, and other organizations, as such 13 terms are defined in section 3371 of title 5, United 14 States Code. 15 (10) HEALTH CARE PROVIDER.—The term 16 ‘‘health care provider’’ has the meaning given the 17 term ‘‘eligible health care provider’’ in title VIII of 18 division B of the CARES Act (Public Law 116– 19 136). 20 (11) HIPAA REGULATIONS.—The term 21 ‘‘HIPAA regulations’’ means parts 160 and 164 of 22 title 45, Code of Federal Regulations. 23 (12) PUBLIC HEALTH AUTHORITY.—The term 24 ‘‘public health authority’’ means an entity that is 25 VerDate Sep 11 2014 16:00 Jun 03, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S3749.IS S3749 pamtmann on DSKBC07HB2PROD with BILLS 7 •S 3749 IS authorized by law to collect or receive information 1 for the purpose of preventing or controlling disease, 2 injury, or disability including, but not limited to, the 3 reporting of disease, injury, vital events such as 4 birth or death, and the conduct of public health sur- 5 veillance, public health investigations, and public 6 health interventions, and a person, such as a des- 7 ignated agency or associate, acting under a grant of 8 authority from, or under a contract with, such public 9 entity, including the employees or agents of such en- 10 tity or its contractors or persons or entities to whom 11 it has granted authority. 12 (13) COVID–19 PUBLIC HEALTH EMER- 13 GENCY.—The term ‘‘COVID–19 public health emer- 14 gency’’ means the outbreak and public health re- 15 sponse pertaining to Coronavirus Disease 2019 16 (COVID–19), associated with the emergency de- 17 clared by the Secretary on January 31, 2020, under 18 section 319 of the Public Health Service Act (42 19 U.S.C. 247d), and any renewals thereof and any 20 subsequent declarations by the Secretary related to 21 the coronavirus. 22 (14) SECRETARY.—The term ‘‘Secretary’’ 23 means the Secretary of Health and Human Services. 24 (15) SERVICE PROVIDER.— 25 VerDate Sep 11 2014 16:00 Jun 03, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S3749.IS S3749 pamtmann on DSKBC07HB2PROD with BILLS 8 •S 3749 IS (A) IN GENERAL.—The term ‘‘service pro- 1 vider’’ means a person that collects, uses, or 2 discloses emergency health data for the sole 3 purpose of, and only to the extent that such en- 4 tity is, conducting business activities on behalf 5 of, for the benefit of, under instruction of, and 6 under contractual agreement with a covered or- 7 ganization. 8 (B) LIMITATION OF APPLICATION.—Such 9 person shall only be considered a service pro- 10 vider in the course of activities described in 11 subparagraph (A). 12 (C) EXCLUSIONS.—The term ‘‘service pro- 13 vider’’ excludes a person that develops or oper- 14 ates a website, web application, mobile applica- 15 tion, or smart device application for the purpose 16 of tracking, screening, monitoring, contact trac- 17 ing, or mitigation, or otherwise responding to 18 the COVID–19 public health emergency. 19 (16) STATE.—The term ‘‘State’’ means each 20 State of the United States, the District of Columbia, 21 each commonwealth, territory, or possession of the 22 United States, and each federally recognized Indian 23 Tribe. 24 (17) THIRD PARTY.— 25 VerDate Sep 11 2014 16:00 Jun 03, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S3749.IS S3749 pamtmann on DSKBC07HB2PROD with BILLS 9 •S 3749 IS (A) IN GENERAL.—The term ‘‘third party’’ 1 means, with respect to a covered organization— 2 (i) another person to whom such cov- 3 ered organization disclosed emergency 4 health data; and 5 (ii) a corporate affiliate or a related 6 party of the covered organization that does 7 not have a direct relationship with an indi- 8 vidual with whom the emergency health 9 data is linked or is reasonably linkable. 10 (B) EXCLUSION.—The term ‘‘third party’’ 11 excludes, with respect to a covered organiza- 12 tion— 13 (i) a service provider of such covered 14 organization; or 15 (ii) a public health authority. 16 (18) USE.—The term ‘‘use’’, with respect to 17 emergency health data, means the processing, em- 18 ployment, application, utilization, examination, or 19 analysis of such data by a covered organization that 20 maintains such data. 21 SEC. 3. PROTECTING THE PRIVACY AND SECURITY OF 22 EMERGENCY HEALTH DATA. 23 (a) RIGHT TO PRIVACY.—A covered organization that 24 collects emergency health data shall— 25 VerDate Sep 11 2014 16:00 Jun 03, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S3749.IS S3749 pamtmann on DSKBC07HB2PROD with BILLS 10 •S 3749 IS (1) only collect, use, or disclose such data that 1 is necessary, proportionate, and limited for a good 2 faith public health purpose, including a service or 3 feature to support such a purpose; 4 (2) take reasonable measures, where possible, to 5 ensure the accuracy of emergency health data and 6 provide an effective mechanism for an individual to 7 correct inaccurate information; 8 (3) adopt reasonable safeguards to prevent un- 9 lawful discrimination on the basis of emergency 10 health data; and 11 (4) only disclose such data to a government en- 12 tity when the disclosure— 13 (A) is to a public health authority; and 14 (B) is made in solely for good faith public 15 health purposes and in direct response to exi- 16 gent circumstances. 17 (b) RIGHT TO SECURITY.—A covered organization or 18 service provider that collects, uses, or discloses emergency 19 health data shall establish and implement reasonable data 20 security policies, practices, and procedures to protect the 21 security and confidentiality of emergency health data. 22 (c) PROHIBITED USES.—A covered organization shall 23 not collect, use, or disclose emergency health data for any 24 purpose not authorized under this section, including— 25 VerDate Sep 11 2014 16:00 Jun 03, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S3749.IS S3749 pamtmann on DSKBC07HB2PROD with BILLS 11 •S 3749 IS (1) commercial advertising, recommendation for 1 e-commerce, or the training of machine-learning al- 2 gorithms related to, or subsequently for use in, com- 3 mercial advertising and e-commerce; 4 (2) soliciting, offering, selling, leasing, licensing, 5 renting, advertising, marketing, or otherwise com- 6 mercially contracting for employment, finance, cred- 7 it, insurance, housing, or education opportunities in 8 a manner that discriminates or otherwise makes op- 9 portunities unavailable on the basis of emergency 10 health data; and 11 (3) segregating, discriminating in, or otherwise 12 making unavailable the goods, services, facilities, 13 privileges, advantages, or accommodations of any 14 place of public accommodation (as such term is de- 15 fined in section 301 of the Americans With Disabil- 16 ities Act of 1990 (42 U.S.C. 12181)), except as au- 17 thorized by a State or Federal Government entity 18 for a public health purpose notwithstanding sub- 19 section (g). 20 (d) CONSENT.— 21 (1) IN GENERAL.—It shall be unlawful for a 22 covered organization to collect, use, or disclose emer- 23 gency health data, unless— 24 VerDate Sep 11 2014 16:00 Jun 03, 2020 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S3749.IS S3749 pamtmann on DSKBC07HB2PROD with BILLS 12 •S 3749 IS (A) the individual to whom the data per- 1 tains has given affirmative express consent to 2 such collection, use, or disclosure; 3 (B) such collection, use, or disclosure is 4 necessary and for the sole purpose of— 5 (i) protecting against malicious, de- 6 ceptive, fraudulent, or illegal activity; or 7 (ii) detecting, responding to, or pre- 8 venting information security incidents or 9 threats; or 10 (C) the covered organization is compelled 11 to do so by a legal obligation. 12 (2) REVOCATION.— 13 (A) IN GENERAL.—A covered organization 14 shall provide an effective mechanism for an in- 15 dividual to revoke consent after it is given. 16 (B) EFFECT.—After an individual revokes 17 consent, the covered organization shall cease 18 collecting, using, or disclosing the individual’s 19 emergency health data as soon as practicable, 20 but in no case later than 15 days after the re- 21 ceipt of the individual’s revocation of consent. 22 (C) DESTRUCTION.—Not later than 30 23 days after the receipt of an individual’s revoca- 24 tion of consent, a covered organization shall de- 25 VerDate Sep 11 2014 16:00 Jun 03, 2020 Jkt 099200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S3749.IS S3749 pamtmann on DSKBC07HB2PROD with BILLS 13 •S 3749 IS stroy or render not linkable that individuals 1 emergency h [Text truncated for display. Full text available on Congress.gov.]