What changed between these versions
A complete substitute amendment. v2 significantly expands and refines the privacy, security, and breach notification standards for applicable health information, introducing new data minimization, retention, and government access restrictions, and strengthening de-identification standards. It also removes several provisions from v1, including a NAS study and specific patient notification requirements for wellness data.
Overview
Extensive changes throughout the bill, with a complete substitute amendment replacing the original text. · v2 fundamentally restructures and expands the regulatory framework for non-HIPAA entities handling health information, while also narrowing certain access conditions and removing specific studies and notification requirements present in v1.
v2 is a complete substitute amendment that fundamentally reworks the Health Information Privacy Reform Act. The most significant changes include the introduction of explicit data minimization, retention, and government access restrictions for regulated entities and service providers in Section 2, alongside a stricter definition of 'applicable health information' and the addition of 'data broker' as a defined term. Furthermore, v2 significantly strengthens the national standards for de-identifying health information in Section 5, prohibiting the use of the 'safe harbor' method alone and adding a direct prohibition on re-identification. Several provisions from v1, such as a NAS study on patient compensation for data sharing and specific patient notification requirements for wellness data, have been removed.
Major additions
This new subsection introduces explicit requirements for regulated entities and service providers regarding data minimization and retention of applicable health information. It mandates that collection, processing, or transfer of AHI cannot exceed what covered entities are permitted, and retention cannot be longer than reasonably necessary. It also lists specific exceptions for these requirements, such as completing transactions, legal obligations, security incidents, public health activities, and research.
This addition significantly strengthens privacy protections by imposing direct limits on how much and for how long non-HIPAA entities can collect and keep sensitive health information, moving beyond just requiring regulations to be promulgated. It creates clear boundaries for data handling.
Mandates that the Secretary and the Federal Trade Commission enter into a memorandum of understanding within 180 days to allocate primary enforcement responsibility, provide for mutual notification of investigations, and prevent duplicative civil penalties for the same act or omission.
This provision is crucial for ensuring coordinated and efficient enforcement of the new privacy standards, preventing jurisdictional disputes and ensuring clarity for regulated entities. It directly addresses the practical implementation of enforcement authority.
A rule of construction clarifying that nothing in the Act limits or supersedes the authority of the Federal Trade Commission under section 5 of the Federal Trade Commission Act (15 U.S.C. 45).
This ensures that the new regulations do not inadvertently curtail the FTC's existing broad authority over unfair or deceptive acts or practices, maintaining a robust regulatory landscape for consumer protection.
Prohibits regulated entities and service providers from selling or otherwise transferring applicable health information to a Federal, State, local, Tribal, or territorial governmental entity unless compelled by a warrant, subpoena, court order, or other compulsory process.
This is a significant new protection against government access to applicable health information held by non-HIPAA entities, requiring a legal mandate for data transfer rather than voluntary sharing or sale. It enhances individual privacy against government surveillance.
Defines "data broker" as a regulated entity whose principal source of revenue is derived from processing or transferring applicable health information that the entity did not collect directly from the individuals to whom such information relates.
This new definition specifically targets entities that aggregate and trade health data, bringing them explicitly under the purview of the Act's regulations and highlighting a key area of privacy concern.
Adds rules of construction clarifying that nothing in Section 3 permits information blocking, treats individuals accessing their own PHI via a personal health record as subject to fees/conditions, or alters existing HITECH Act rights.
These clarifications are important for preventing unintended consequences, ensuring that the bill's provisions on access rights do not conflict with existing information blocking prohibitions or undermine an individual's fundamental right to their own health data.
Establishes a direct prohibition on any entity that receives de-identified information from re-identifying or attempting to re-identify such information. A violation of this prohibition is enforceable and subject to civil penalties under Section 2(c).
This is a critical new protection, creating a legal barrier against the re-identification of data that has been ostensibly de-identified. It significantly strengthens the integrity of de-identification standards and provides a clear enforcement mechanism.
Deletions
This section amended Section 543 of the Public Health Service Act (42 U.S.C. 290dd-2), which governs the confidentiality of substance use disorder records. The amendments primarily updated cross-references within that section to refer to "the HIPAA regulations" instead of specific subsections.
The deletion removes the proposed updates to the confidentiality rules for substance use disorder records. This means that the existing statutory language for 42 U.S.C. 290dd-2 remains unchanged by this bill, potentially leaving some of the intended harmonization with HIPAA unaddressed.
This section mandated the Secretary of Health and Human Services to contract with the National Academies of Sciences, Engineering, and Medicine to conduct a study on the potential risks and benefits of compensating patients for sharing their identifiable data for research purposes. The study was to include examinations of privacy risks, enhancing tools, consent tracking, ethical considerations, opt-in/opt-out for de-identified data, and re-identification risks.
The deletion removes a planned study that would have explored complex ethical and practical issues surrounding patient compensation for data sharing. This means that the insights and recommendations from such a study, which could have informed future policy, will not be generated under this Act.
This section established patient notification requirements for regulated entities and service providers. It required notification to individuals when their protected health information (accessed via patient right of access) would no longer be subject to HIPAA protections, including an explanation of redisclosure and requiring consent for selling to third parties. It also mandated notifications and opt-out opportunities for individuals using digital technology that generates "wellness data" (e.g., vital statistics, step counts), informing them that such data would not be subject to HIPAA.
The deletion removes specific, explicit notification requirements that aimed to inform individuals about the loss of HIPAA protections for their data once it leaves HIPAA-covered entities, and for data generated by wellness technologies. This means that these direct, consumer-facing notifications and opt-out opportunities, particularly for wellness data, will not be mandated by this Act.
Modifications
Individuals gain stronger and more explicit privacy rights, particularly regarding the sale and marketing of their health information and the ability to control its digital flow. Regulated entities face more stringent requirements and a clearer timeline for compliance with new regulations, including a new prohibition on certain uses related to health care access.
Before
Directed HHS to promulgate regulations for privacy, security, and breach notifications for applicable health information by regulated entities and service providers, with standards commensurate with HIPAA/HITECH. It listed general privacy requirements including permitted/prohibited uses, minimum necessary, individual rights (access, amendment, deletion, portability), and administrative safeguards.
After
Retains the core directive but specifies an 18-month deadline for promulgation. It strengthens the language to "at least equivalent to" HIPAA/HITECH rights and protections. It adds a prohibition on using AHI to investigate or impose liability related to seeking/obtaining/providing/facilitating health care. It explicitly requires written authorization for any sale, licensing, transfer, or marketing of AHI. It refines the description of minimum necessary requirements to include "purpose specification, collection limitation, data minimization, and limitation on secondary use" and links them to new subsection (b). It expands individual rights to include the ability to direct electronic health record transmission to third parties, a 30-day timeframe for deletion requests, and the ability to transfer information between applications, services, or devices.
The inclusion of precise geolocation data provides new protections for individuals seeking health services, especially sensitive ones. However, the extensive list of exclusions means that certain types of health-related information, previously potentially covered by v1's broad definition, will now fall outside the scope of this Act if already governed by other specified laws. This clarifies jurisdictional boundaries but potentially limits the reach of the new protections in those specific areas.
Before
Defined "applicable health information" as information that identifies an individual and relates to their health or health care payment, and explicitly included information not created or received by traditional health entities (providers, plans, employers, clearinghouses).
After
Retains the core definition but adds "precise geolocation information that could reasonably indicate an attempt by an individual to acquire or receive a health service or supply" to the inclusions. Crucially, it adds a list of exclusions for information already subject to other specific privacy laws (e.g., Gramm-Leach-Bliley Act, FERPA, human subjects research regulations, 42 U.S.C. 290dd-2), as well as publicly available information and information collected for purely personal/household activity.
Data brokers are now unequivocally subject to these new privacy regulations, increasing accountability for entities whose business model relies on secondary data processing. The refined exclusions provide greater clarity for other entities regarding their regulatory obligations.
Before
Defined "regulated entity" as a natural or legal person determining the purpose and means of processing applicable health information, excluding governmental entities, those acting on behalf of government, and covered entities/business associates.
After
Retains the core definition but explicitly includes "a data broker" (a newly defined term) and clarifies the exclusion to specifically cover "a covered entity or business associate, with respect to protected health information" and "an individual who is the subject of the applicable health information or who obtains applicable health information in a personal or household capacity." It removes the exclusion for governmental entities and those acting on their behalf, as government access is now addressed in Section 2(e).
For individuals, the process of directing PHI to a third party might be streamlined by removing the explicit authorization requirement, but the scope is now limited to electronic health records. For covered entities/business associates, the conditions for transmitting PHI to third parties are clarified and slightly less stringent regarding authorization, but still allow for fees and terms.
Before
Allowed covered entities/business associates to condition the transmission of PHI to a designated person on a valid authorization, payment of fees, and acceptance of terms. It applied broadly to "a copy of the individual's protected health information."
After
Narrows the scope to apply only to PHI "in an electronic health record." It removes the requirement that the individual's request meet all requirements of a valid authorization under 45 CFR 164.508(b). It retains the ability to condition transmission on fees and acceptance of terms.
For individuals, the ability to direct PHI to a personal health record is explicitly recognized as a scenario where fees may apply. The removal of the "other persons" category with specific limitations might streamline fee application but could also remove some flexibility for third-party access.
Before
Specified that fees for access/production/copying/transmittal of PHI apply only when provided directly to the individual/personal representative, certain other persons (with limitations), or the individual's health care provider/business associates, or for electronic transmittal to a patient portal/mobile app.
After
Simplifies the application of fees, stating they apply only to the provision of access/production/copying/transmittal of PHI to the individual/personal representative, the individual's health care provider/business associates, or "a personal health record managed and controlled by the individual." It removes the specific limitations on "other persons" and the separate provision for patient portals/mobile apps, integrating the concept of a "personal health record."
This change significantly strengthens the regulatory oversight of how health information (both PHI and AHI) is used in AI/ML development, ensuring more robust and legally binding standards rather than advisory guidance. It provides greater clarity for developers and users of AI/ML in health, and offers ongoing adaptation to technological advancements through periodic review.
Before
Directed HHS to publish guidance on the application of the minimum necessary standard to data used for artificial intelligence and other machine learning applications, including interoperability requirements and limited data sets.
After
Renumbered to Section 4. Now mandates rulemaking (regulations) instead of just guidance, within 1 year. Requires coordination with FDA Commissioner and National Coordinator for Health IT. Expands the scope to include AHI and PHI used to "train, develop, validate, modify, or operate an artificial intelligence or other machine learning model." It specifies contents for the regulations, including clarifying that the standard does not permit denial/delay due to technical feasibility, detailing its application to AI/ML model development (including when larger datasets are necessary and how privacy-enhancing technologies satisfy it), and addressing interoperability. It also adds a new requirement for periodic review and updates every 3 years.
This change imposes a much higher bar for de-identifying health information, making it significantly more difficult for entities to claim data is de-identified without rigorous analysis. This provides stronger privacy protections for individuals by reducing the risk of re-identification. Entities handling de-identified data will face increased compliance burdens and costs associated with meeting these stricter standards.
Before
Required de-identification standards to be at least equivalent to or exceed the HIPAA de-identification standard (45 CFR 164.514(b)), specify privacy-enhancing technologies, and require contractual agreements not to re-identify.
After
Renumbered to Section 5(b). Significantly modifies paragraph (1) to state that standards must be "at least as protective as the de-identification standard specified in section 164.514(b)(1)" (expert determination) and "may not permit information to be rendered de-identified information solely through the method specified in section 164.514(b)(2)" (safe harbor). It also adds a new paragraph (4) requiring standards to "account for evolving methods of re-identification, including methods that use artificial intelligence or machine learning."
Scope
Complete substitute — Changes are scattered throughout the bill, affecting nearly every section, with a complete replacement of the original text. — v2 represents a meaningful change in policy direction by introducing explicit operative requirements for data minimization, retention, and government access, and by significantly strengthening de-identification standards, moving beyond merely directing the promulgation of regulations. It also narrows the scope of "applicable health information" by adding specific exclusions. — The changes interact significantly with existing HIPAA and HITECH provisions, aiming for harmonization while also establishing new, more stringent requirements for non-HIPAA entities. The new exclusions for "applicable health information" clarify jurisdictional boundaries with other federal privacy laws.
Impact analysis
Individuals whose health information is processed by regulated entities and service providers (non-HIPAA covered entities).
Gain new rights and protections.
Gain stronger privacy protections, including explicit rights regarding the sale, licensing, transfer, or marketing of their applicable health information, and enhanced control over digital transmission and deletion of their data. They also benefit from new data minimization and retention requirements and a direct prohibition on government access without compulsory process.
Regulated entities and service providers (non-HIPAA covered entities, including data brokers).
Face increased compliance burdens and operational restrictions.
Face significantly expanded and more stringent regulatory obligations, including explicit data minimization, retention, and government access restrictions. They must also comply with stricter de-identification standards and a direct prohibition on re-identification. The definition of 'regulated entity' now explicitly includes 'data brokers'.
Entities involved in AI/Machine Learning development using health data.
Face increased regulatory scrutiny and clearer, potentially more restrictive, rules for data use.
Will be subject to formal regulations (instead of guidance) on the application of the minimum necessary standard to health information used in AI/ML models, including specific requirements for data minimization and the use of privacy-enhancing technologies.
Researchers seeking to compensate patients for data sharing.
Lose a potential avenue for policy development and guidance.
The provision for a National Academies of Sciences study on this topic was removed.
Individuals using digital wellness technologies.
Lose specific notification rights.
The specific patient notification requirements and opt-out opportunities for wellness data, which were present in v1, have been removed.
Entities handling health information already covered by other federal privacy laws (e.g., Gramm-Leach-Bliley, FERPA, human subjects research regulations, 42 U.S.C. 290dd-2).
Gain clarity on jurisdictional boundaries, potentially reducing regulatory burden.
Information subject to these other laws is now explicitly excluded from the definition of "applicable health information" under this Act.
Covered entities and business associates transmitting electronic health records to third parties designated by individuals.
Experience procedural clarification, potentially easing some administrative burden while maintaining existing rights and responsibilities.
The requirement for the individual's request to meet all requirements of a valid authorization under 45 CFR 164.508(b) for such transmissions has been removed. Conditions for fees and acceptance of terms remain, and new rules of construction clarify that information blocking is not permitted.