Health Information Privacy Reform Act

This bill would require the Department of Health and Human Services, working with the Federal Trade Commission, to write privacy, security, and breach notification rules within 18 months for health information held by companies not already covered by HIPAA, such as health apps and data brokers. These rules would give people rights to access, correct, delete, and move their health information, and would require written permission before such information is sold or licensed. Companies would be limited in how much health information they collect and how long they keep it, and could not sell or transfer it to government agencies without a warrant, subpoena, or court order. The bill would also set national standards for removing identifying details from health data, ban attempts to re-identify such data, and require rules on how health data may be used to train artificial intelligence.

Full text and official record on Congress.gov

Sponsors

• Bill Cassidy Republican sponsor
• 1 cosponsors