Health Data De-identification Report Act

II 116TH CONGRESS 2D SESSION S. 4990 To require the Office for Civil Rights of the Department of Health and Human Services to conduct a study and issue a report on the de- identification of data pursuant to privacy regulations. IN THE SENATE OF THE UNITED STATES DECEMBER 9, 2020 Mr. CASSIDY introduced the following bill; which was read twice and referred to the Committee on Health, Education, Labor, and Pensions A BILL To require the Office for Civil Rights of the Department of Health and Human Services to conduct a study and issue a report on the de-identification of data pursuant to privacy regulations. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Health Data De-identi- 4 fication Report Act’’. 5 VerDate Sep 11 2014 23:54 Dec 15, 2020 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S4990.IS S4990 pamtmann on DSKBC07HB2PROD with BILLS 2 •S 4990 IS SEC. 2. STUDY AND REPORT BY THE HHS OFFICE FOR CIVIL 1 RIGHTS. 2 (a) IN GENERAL.—The Office for Civil Rights of the 3 Department of Health and Human Services, in coopera- 4 tion with the National Institute of Standards and Tech- 5 nology, shall conduct a study that considers and compares 6 the effectiveness and validity of safe harbor and expert 7 determination as methods of carrying out the de-identi- 8 fication of data required under section 164.514 of title 45, 9 Code of Federal Regulations (as in effect on the date of 10 enactment of this Act), and shall submit to Congress a 11 report on such study not later than 270 days of the date 12 of enactment of this Act. 13 (b) CONTENT OF STUDY AND REPORT.—The study 14 and report under subsection (a) shall consider— 15 (1) any known instances where data that was 16 de-identified as required under section 164.514 of 17 title 45, Code of Federal Regulations (as in effect on 18 the date of enactment of this Act) became re-identi- 19 fied, even partially, and, with respect to each such 20 instance, how such re-identification occurred and 21 any harm incurred by any individual whose data was 22 re-identified; 23 (2) the frequency by which each of the safe har- 24 bor method and the expert determination method is 25 used for the de-identification of data as described in 26 VerDate Sep 11 2014 23:54 Dec 15, 2020 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S4990.IS S4990 pamtmann on DSKBC07HB2PROD with BILLS 3 •S 4990 IS subsection (a), and the sizes of the data sets on 1 which each such method is used; 2 (3) the costs of each such method of de-identi- 3 fication, and the relative utility of the data that is 4 de-identified through each such method; 5 (4) which of the 2 methods of de-identification 6 renders data less likely to be easily re-identifiable; 7 (5) whether either such method removes infor- 8 mation that would help address health care dispari- 9 ties, thereby making it more difficult to address such 10 disparities; 11 (6) which of the 2 methods is most commonly 12 used for purposes of medical research, and the bene- 13 fits and disadvantages of using each such method 14 for such purpose; 15 (7) the risk of re-identification by each of the 16 2 methods, especially when the resulting de-identi- 17 fied dataset will be accessible by entities that have 18 access to additional data; 19 (8) whether or not there are use cases that can- 20 not be performed using data de-identified by either 21 of the 2 methods; and 22 VerDate Sep 11 2014 23:54 Dec 15, 2020 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S4990.IS S4990 pamtmann on DSKBC07HB2PROD with BILLS 4 •S 4990 IS (9) the ease or difficulty of expert determina- 1 tion, taking into consideration cost, accessibility, and 2 qualifications of experts. 3 Æ VerDate Sep 11 2014 23:54 Dec 15, 2020 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6301 E:\BILLS\S4990.IS S4990 pamtmann on DSKBC07HB2PROD with BILLS