A complete substitute amendment. v2 significantly expands and refines the privacy, security, and breach notification standards for applicable health information, introducing new data minimization, retention, and government access restrictions, and strengthening de-identification standards. It also removes several provisions from v1, including a NAS study and specific patient notification requirements for wellness data.
Health Information Privacy Reform Act
- Sponsor
- Sen. Cassidy, Bill [R-LA]
- Committees
- Health, Education, Labor, and Pensions Committee (primary)
- Last action
- Aug 4, 2026
Bottom line
The bill significantly expands federal health data privacy protections to a broader range of entities and data types beyond traditional HIPAA-covered entities, while also refining existing HIPAA rules.
What it actually does
This bill establishes new federal privacy, security, and breach notification standards for "applicable health information" processed by "regulated entities" and their "service providers" that are not currently covered by HIPAA. It mandates regulations to create protections at least equivalent to HIPAA, including individual rights like access, amendment, deletion, and portability. The bill also modifies existing HIPAA rules regarding patient access to protected health information, clarifies minimum necessary standards for AI/ML data use, and establishes new standards for de-identified health information, prohibiting re-identification.
Proponents argue
Supporters argue this legislation closes critical gaps in health data privacy, particularly concerning data collected by non-HIPAA entities like fitness trackers, wellness apps, and data brokers. They contend it empowers individuals with greater control over their health information, ensures consistent protections across the health data ecosystem, and promotes responsible innovation by clarifying rules for AI/ML development and de-identification.
Opponents contend
Opponents might argue that the bill imposes overly burdensome regulatory requirements on a wide array of entities, potentially stifling innovation and increasing compliance costs, especially for smaller businesses. Concerns could also be raised about the practicalities of implementing new deletion and portability rights across diverse data systems, and whether the new standards truly harmonize with existing frameworks or create new complexities.
The bill is moderately complex, requiring careful reading to understand its interplay with existing regulations. The estimated reading time is reasonable for an informed stakeholder to grasp its core implications.
Section 2(a)
Federal Privacy, Security, and Breach Notification Standards for Non-HIPAA Entities
This provision directs the Secretary of Health and Human Services (HHS), in consultation with the Federal Trade Commission (FTC), to create new regulations. These regulations will establish privacy, security, and breach notification standards for "applicable health information" handled by "regulated entities" (like data brokers, wellness apps) and their "service providers" that are not already covered by HIPAA. The standards must be at least equivalent to HIPAA's protections and, where feasible, harmonize with them.
Supporters argue
Supporters argue this provision closes a significant gap in federal privacy law, extending crucial protections to health data collected by non-traditional healthcare entities. They contend it creates a more uniform privacy landscape, preventing situations where sensitive health information lacks adequate safeguards simply because it wasn't collected by a doctor or hospital.
Critics contend
Critics might argue that this creates an overly broad and burdensome regulatory framework for entities not traditionally considered healthcare providers. They may contend that it could stifle innovation in health technology and impose significant compliance costs, particularly on smaller tech companies, without clear evidence of widespread harm that existing consumer protection laws cannot address.
Tradeoffs
Balances the desire for comprehensive health data privacy with concerns about regulatory burden and potential impacts on innovation in the health tech sector.
Section 2(a)(1)(G)
New Individual Rights for Non-HIPAA Health Data
This section mandates that the new regulations for "applicable health information" must include specific individual rights. These rights mirror many found in HIPAA, such as the right to receive a privacy notice, access their health information, amend it, delete it (within 30 days), and port it (transfer between apps/services). It also requires written authorization for sale, licensing, transfer, or marketing of this data.
Section 2(b)
Data Minimization and Retention Limits for Applicable Health Information
This provision prohibits regulated entities and service providers from collecting, processing, or transferring "applicable health information" beyond what HIPAA-covered entities are permitted to do. It also limits retention of this data to only what is reasonably necessary for the original collection purpose, with specific exceptions for transactions, legal obligations, security, public health, and research.
Section 2(e)
Restrictions on Government Access to Applicable Health Information
This section explicitly prohibits regulated entities and service providers from selling or transferring "applicable health information" to any federal, state, local, tribal, or territorial governmental entity unless compelled by a warrant, subpoena, court order, or other compulsory legal process.
Section 3(a) and (b)
Conditions and Fee Limitations for Third-Party Access to Electronic Health Records
This section modifies existing HIPAA rules regarding an individual's right to direct a covered entity or business associate to transmit their protected health information (PHI) in an electronic health record to a designated third party. It allows the covered entity/business associate to condition this transmission on the third party paying fees (consistent with state law and subsection (b)) and acknowledging/accepting the terms of use/disclosure. Subsection (b) clarifies that fee limitations only apply when PHI is provided directly to the individual, their personal representative, their healthcare provider, or a personal health record managed by the individual.
Section 4
Rulemaking on Minimum Necessary Standard for AI/Machine Learning Data Use
This section mandates HHS, in coordination with FDA and the National Coordinator for Health Information Technology, to issue new regulations within one year. These regulations will clarify how the "minimum necessary" standard (from HIPAA) applies to both "applicable health information" and "protected health information" when used to train, develop, validate, modify, or operate artificial intelligence (AI) or machine learning (ML) models. It clarifies that inability to technically limit disclosure doesn't excuse reasonable efforts and specifies how larger datasets might be justified for AI/ML development.
Section 5
Unified National Standards for De-identified Health Information and Re-identification Ban
This section mandates HHS to establish unified national standards for de-identifying "applicable health information" within one year. These standards must be at least as protective as HIPAA's "expert determination" method (not just "safe harbor") and must account for evolving re-identification methods, including AI/ML. It also requires contractual agreements not to re-identify data when shared and explicitly prohibits any entity receiving de-identified information from re-identifying or attempting to re-identify it, with violations subject to civil penalties.
The definition of "applicable health information" explicitly excludes information already subject to several other privacy laws, including Gramm-Leach-Bliley Act (financial data), Section 543 of the Public Health Service Act (substance use disorder records), FERPA (educational records), federal human subjects research regulations (Common Rule, FDA), Health Care Quality Improvement Act, and part C of title IX of the Public Health Service Act (AHRQ research). It also excludes publicly available information and information collected/processed by an individual for purely personal/household activity.
Section 2(f)(1)(C)
Why it matters:This is standard legislative practice to avoid overlapping jurisdiction and ensure clarity on what data is not covered by the new regime. It's a carve-out that defines the boundaries of the bill's scope.
Case for: Ensures that entities already compliant with other specific privacy frameworks are not subjected to duplicative or conflicting regulations under this Act, promoting regulatory efficiency.
Case against: No specific opposition is typically raised against such carve-outs when they prevent regulatory overlap. However, some might argue that the fragmentation of privacy laws across different sectors remains a challenge, even with these clarifications.
Estimated impact: Significantly narrows the scope of the bill to data not already covered by major federal privacy or research protection laws, focusing on the "gap" entities.
The bill explicitly defines "data broker" as a regulated entity whose principal revenue source is processing or transferring "applicable health information" not collected directly from individuals. This definition ensures that data brokers are squarely within the scope of the new privacy and security regulations.
Section 2(f)(3) and (4)
Why it matters:This is a critical definitional inclusion to ensure the bill achieves its stated purpose of covering entities outside traditional HIPAA scope. It's technically phrased but substantively consequential.
Case for: Supporters argue this is essential to address the unregulated trade of sensitive health data by third-party aggregators, a primary driver for the bill's existence. It ensures accountability for entities profiting from health information they did not directly collect.
Case against: Data brokers might argue that this definition is overly broad or that the compliance burden will be disproportionately high, potentially impacting their business models and the availability of data for legitimate secondary uses (e.g., market research, public health analytics).
Estimated impact: Brings a significant segment of the health data ecosystem, previously largely unregulated for privacy, under federal oversight.
The definition of "applicable health information" explicitly includes "precise geolocation information that could reasonably indicate an attempt by an individual to acquire or receive a health service or supply."
Section 2(f)(1)(B)(ii)
Why it matters:This is a targeted inclusion to address specific privacy concerns, such as tracking individuals visiting reproductive health clinics or other sensitive medical facilities. It's technically precise but politically charged.
Case for: Proponents argue this is a crucial protection against the misuse of location data to infer sensitive health decisions, particularly in the context of reproductive healthcare access. It directly addresses a known privacy vulnerability.
Case against: Some tech companies or data aggregators might argue that this is difficult to implement, as "reasonably indicate" is subjective, and could lead to over-collection of data to determine if it falls under the definition, or under-collection to avoid liability.
Estimated impact: Provides specific federal protection for a type of data that has been a focus of recent privacy debates, especially post-Roe v. Wade.