S 3097 — Health Information Privacy Reform Act

1320d-9(b)(3));

and</DELETED> <DELETED> (3) the terms ``regulated entity'' and ``service provider'' have the meanings given such terms in section 2.</DELETED> <DELETED> (d) Effective Date.--This section shall take effect beginning one year after the date of enactment of this Act.</DELETED> <DELETED>SEC.

7.

MINIMUM NECESSARY GUIDANCE.</DELETED> <DELETED> Not later than 1 year after the date of enactment of this Act, the Secretary of Health and Human Services shall publish guidance on the application of the minimum necessary standard to data used for artificial intelligence and other machine learning applications and relevant requirements, including health data interoperability requirements under section 3001(c)(9) of the Public Health Service Act (42 U.S.C.

300jj-11(c)(9)) and the use of limited data sets pursuant to section 13405(b) of the HITECH Act (42 U.S.C.

17935(b)).</DELETED> <DELETED>SEC.

8.

DE-IDENTIFIED INFORMATION.</DELETED> <DELETED> (a) Establishment of Standards.--Not later than 1 year after the date of enactment of this Act, the Secretary of Health and Human Services shall promulgate regulations establishing unified national standards for rendering applicable health information as de- identified information, in a manner similar to the manner in which individually identifiable health information may be rendered de- identified information pursuant to part 164 of title 45, Code of Federal Regulations (or any successor regulations).</DELETED> <DELETED> (b) Composition of Standards.--Such standards shall-- </DELETED> <DELETED> (1) be at least equivalent to or exceed the de- identification standard specified in section 164.514(b) of title 45, Code of Federal Regulations (or any successor regulations);</DELETED> <DELETED> (2) specify standards for the use of privacy- enhancing technologies as a method for creating de-identified information;

and</DELETED> <DELETED> (3) specify that information shall not qualify as de-identified information when provided by a regulated entity, service provider, covered entity, or business associate to another person or entity unless such person or entity contractually agrees in writing not to re-identify or attempt to re-identify the information, and to require the same of any person or entity to whom such person or entity provides the information.</DELETED> <DELETED> (c) Definitions.--In this section--</DELETED> <DELETED> (1) the term ``applicable health information'' has the meaning given such term in section 2;</DELETED> <DELETED> (2) the terms ``business associate'', ``covered entity'', and ``individually identifiable health information'' have the meanings given such terms in section 160.103 of title 45, Code of Federal Regulations (or any successor regulations);

and</DELETED> <DELETED> (3) the term ``privacy enhancing technologies'' means any software or hardware solution, technical process, or other technological means of mitigating individuals' privacy risks arising from data processing by enhancing predictability, manageability, disassociability, and confidentiality.</DELETED> <DELETED>SEC.

9.

PREEMPTION.</DELETED> <DELETED> Section 160.203 of title 45, Code of Federal Regulations (or any successor regulations) shall apply to the requirements set forth under this Act in the same manner and to the same extent as such section applies to the standards, requirements, and implementation specifications under subchapter C of chapter I of subtitle A of title 45, Code of Federal Regulations (or any successor regulations).</DELETED> SECTION 1.

(a) In General.--TheGeneral.--Not later than 18 months after the date of enactment of this Act, the Secretary of Health and Human Services,Services (referred to in this section as the ``Secretary''), in consultation with the Federal Trade Commission, shall promulgate regulations settingestablishing and implementing privacy, security, and breach notificationsnotification standards for the processing of applicable health information by regulated entities and their service providers.

Such standards shall provide rights and protections that are at least commensurateequivalent with,to, and that, wherever feasible and appropriateappropriate, harmonize with, the rights and protections provided through the privacy, security, and breach notification rules promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C.

1320d-2 note) and section 13402 of the HITECH Act (42 U.S.C.

(A) Permitted uses and disclosures of applicable health information without an individual's written authorization that are consistent with the individual's reasonable expectations.expectations, taking into consideration the context in which the applicable health information was obtained, provided that such regulations shall not authorize such a use or disclosure to investigate, or to impose liability on, any individual in connection with the seeking, obtaining, providing, or facilitating of health care.

(B) OtherUses permitted uses and disclosures of applicable health information withoutthat anrequire the individual's written authorization forand certainthe publicrequirements policyrelated purposes,to such aswritten publicauthorizations, health,including healthhow oversight,the lawindividual enforcement,may judicialrevoke andsuch administrativeauthorization, proceedings,which andshall anyinclude conditionsrequiring the individual's written authorization for suchany usessale, andlicensing, disclosures.transfer, or marketing of applicable health information.

(C) UsesProhibited uses and disclosures of applicable health informationinformation. that require the individual's written authorization and the requirements related to such written authorizations.

(D) ProhibitedMinimum usesnecessary requirements for the request, use, and disclosuresdisclosure of applicable health information.information and any exceptions that are necessary for purpose specification, collection limitation, data minimization, and limitation on secondary use and that are consistent with subsection (b).

(E) MinimumStandards necessaryand requirements for an individual to be authorized to exercise the request,rights use,granted andin disclosurethis ofsection with respect to applicable health information andof anyanother exceptions.individual.

(F) Standards and requirements related to legalservice representativesproviders. of the individual.

(G)(G)(i) StandardsIndividual andrights requirementswith relatedrespect to serviceapplicable providers.health information, including the following:

(H)(I) IndividualThe rights with respect to applicable health information, including the right of the individual to receive a privacy notice from the regulated entity, accesswhich toshall applicabledescribe healththe information,purposes amendmentfor ofwhich applicablethe healthregulated information,entity deletionuses of applicable health information, and portabilitydiscloses of applicable health information, andthe any exceptions to such rights (suchof asthe withindividual respectunder tothis applicablesubparagraph, health information collected for research purposes), any conditions on such rights, and anythe othermanner requirementsin relatedwhich to such rights,rights includingmay timeframesbe forexercised. responding to requests.

(I)(II) AdministrativeThe safeguards,right of access to applicable health information, including designationthe ability of athe privacyindividual officer,to policiesdirect andthe procedures,transmission training of workforceapplicable members,health non-information retaliation,held documentation,in andan mitigation.electronic health record to a third party.

(III) The right to amendment of applicable health information.

(IV) The right to deletion of applicable health information, not later than 30 days after the regulated entity or service provider receives a request for such a deletion, and allowing for the regulated entity or service provider to communicate with the individual making such request prior to fulfilling such request.

(V) The right to portability of applicable health information, including the ability of the individual to transfer such information between applications, services, or devices.

(ii) Any exception to, or condition or other requirement on, a right described in any of subclauses (I) through (V) of clause (i), including an exception with respect to applicable health information collected for research purposes and a timeframe for responding to a request of an individual for applicable health information.

(H) Administrative safeguards, including designation of a privacy officer, policies and procedures, training of workforce members, non- retaliation, documentation, and mitigation.

(A) Physical, technical, and administrative safeguards for applicable health information in anywritten or oral form.

(B) ForThe electronicapplication applicableof healththe information,standards suchunder safeguardssubpart shallC beof basedpart on164 well-establishedof nationaltitle frameworks,45, suchCode asof cybersecurityFederal performanceRegulations goals(or ofany thesuccessor Nationalregulations) Instituteto ofelectronic Standardsapplicable andhealth Technologyinformation orin the Departmentsame ofmanner Healthas andsuch Humanstandards Services.apply to electronic protected health information.

(3) Breach notification requirements in the event of a breach of applicable health information that are substantially similar to the breach notification requirements under subpart D of part 164 of title 45, Code of Federal Regulations (or any successor regulations) for applicable health information that is not subject to the health breach notification rule at part of title 16, Code of Federal Regulations (or any successor regulations).

(b) EnforcementRequirements Authority.--Thefor Secretary,Regulated inEntities consultationand withService theProviders.-- Federal(1) TradeData Commission,minimization.--A regulated entity or service provider may not collect, process, or transfer applicable health information beyond what a covered entity is authorizedpermitted to enforcecollect, allprocess, provisionsor transfer under sections 164.502(b) and 164.514(d) of thistitle Act45, asCode describedof inFederal subsectionRegulations (c).(or any successor regulations).

(c)(2) CivilRetention.--A Penalties.--In addition to any other sanctions or remedies that may be available under any provision of Federal law, in the case of a regulated entity or service provider thatmay violatesnot thisretain section,applicable subparthealth Dinformation offor partlonger 160than ofis titlereasonably 45,necessary Code of Federal Regulations (or any successor regulations), shall apply to thecarry regulatedout entity or service provider with respect to such violation of this section in the samepurpose mannerfor thatwhich such subpartinformation applieswas tocollected. a person with respect to a violation of part 160 of title 45, Code of Federal Regulations (or any successor regulations).

(3) Exceptions.--Paragraphs (1) and (2) shall not apply to the collection, processing, or transfer of applicable health information to the extent reasonably necessary for any of the following purposes:

(A) To complete a transaction or provide a product or service specifically requested by the individual to whom such information relates.

(B) To comply with a legal obligation, or to establish, exercise, or defend a legal claim.

(C) To prevent, detect, or respond to a security incident, fraud, or harm to an individual.

(D) To carry out a public health activity permitted under the regulations promulgated under subsection (a).

(E) To conduct research subject to part 46 of title 45, Code of Federal Regulations, or part 50 or 56 of title 21, Code of Federal Regulations (or any successor regulations).

(c) Enforcement.-- (1) Coordination.--Not later than 180 days after the date of enactment of this Act, the Secretary and the Federal Trade Commission shall enter into a memorandum of understanding that allocates primary enforcement responsibility under this section, provides for mutual notification of investigations into violations of this section, and ensures that a regulated entity or service provider is not subject to duplicative civil penalties for the same act or omission.

(2) Rule of construction.--Nothing in this Act shall be construed to limit or supersede the authority of the Federal Trade Commission under section 5 of the Federal Trade Commission Act (15 U.S.C.

45).

(3) Civil penalties.--In addition to any other sanctions or remedies that may be available under any provision of Federal law, in the case of a regulated entity or service provider that violates this section, subpart D of part 160 of title 45, Code of Federal Regulations (or any successor regulations) shall apply to the regulated entity or service provider with respect to such violation of this section in the same manner that such subpart applies to a person with respect to a violation of part 160, 162, or 164 of subchapter C of chapter I of subtitle A of title 45, Code of Federal Regulations (or any successor regulations).

Any funds collected through civil penalties under this paragraph shall be used to support enforcement activity under this section.

(e)Not Definitions.--Inlater than 18 months after the date of enactment of this section:Act, the Secretary shall promulgate regulations to carry out this subsection.

(1)(e) ApplicableGovernment healthAccess.--A information.--Theregulated termentity ``applicableor healthservice information''--provider (A)may meansnot informationsell (includingor demographicotherwise information)transfer that--applicable (i)health identifiesinformation anto individuala orFederal, withState, respectlocal, toTribal, whichor thereterritorial isgovernmental aentity reasonableexcept basisas tocompelled believeby thatwarrant, thesubpoena, informationcourt couldorder, beor usedother tocompulsory identifyprocess. an individual;

and(f) (ii)Definitions.--In relatesthis tosection: the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual;

and(1) (B)Applicable mayhealth includeinformation.--The informationterm described``applicable inhealth subparagraphinformation''-- (A) means information (including demographic information)-- (i) that wasidentifies notan createdindividual or receivedwith byrespect to which there is a healthreasonable carebasis provider,to healthbelieve plan,that employer,the orinformation healthcould carebe clearinghouse.used to identify an individual;

and (ii) that relates to the past, present, or future physical or mental health or condition of such individual, the past, present, or future provision of health care to such individual, or past, present, or future payment for the provision of health care to such individual;

(B) includes-- (i) information described in subparagraph (A) that was not created or received by a health care provider, health plan, employer, or health care clearinghouse;

and (ii) precise geolocation information that could reasonably indicate an attempt by an individual to acquire or receive a health service or supply;

and (C) does not include-- (i) information subject to-- (I) title V of the Gramm-Leach- Bliley Act (15 U.S.C.

6801 et seq.);

(II) the requirements regarding the confidentiality of substance use disorder information under section 543 of the Public Health Service Act (42 U.S.C.

290dd-2);

(III) section 444 of the General Education Provisions Act (20 U.S.C.

1232g;

commonly known as the ``Family Educational Rights and Privacy Act of 1974'') and part 99 of title 34, Code of Federal Regulations (or any successor regulations) to the extent such regulated entity or service provider is an educational agency or institution as defined in such section of such Act or section 99.3 of title 34, Code of Federal Regulations (or any successor regulations);

(IV) provisions for the protection of identifiable private information that is collected pursuant to-- (aa) the Federal requirements for the protection of human subjects under part 46 of title 45, Code of Federal Regulations or part 50 or 56 of title 21, Code of Federal Regulations (or any successor regulations);

or (bb) the good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use;

(V) the Health Care Quality Improvement Act of 1986 (42 U.S.C.

et seq.);

or (VI) part C of title IX of the Public Health Service Act (42 U.S.C.

299b-21 et seq.);

(ii) publicly available information;

or (iii) information collected, processed, or transferred by an individual in the course of a purely personal or household activity.

(3) RegulatedData entity.--Thebroker.--The term ``regulated``data entity''--broker'' (A) means a naturalregulated orentity legalwhose personprincipal that,source aloneof revenue is derived from processing or jointlytransferring withapplicable others,health determinesinformation that the purposeentity anddid meansnot ofcollect processingdirectly applicablefrom healththe information;individuals to whom such information relates.

and(4) (B)Regulated doesentity.--The notterm include--``regulated (i)entity''-- a(A) governmentalmeans entitya suchnatural asor alegal body,person, authority,including board,a bureau,data commission,broker, district,that, agency,alone or politicaljointly subdivisionwith ofothers, determines the Federal,purpose State,and ormeans localof government;processing applicable health information;

(ii)and a(B) persondoes ornot aninclude-- entity(i) thata is collecting, processing, or transferring covered dataentity on behalf of or abusiness Federal,associate, State,with Tribal,respect territorial,to orprotected localhealth governmentinformation; entity;

andor (iii)(ii) aan coveredindividual entitywho oris businessthe associate,subject asof suchthe termsapplicable arehealth definedinformation inor sectionwho 160.103obtains ofapplicable titlehealth 45,information Codein ofa Federalpersonal Regulationsor (orhousehold anycapacity. successor regulations).

(4)(5) Service provider.--The term ``service provider'' means a natural or legal entity that processes applicable health information on a behalf of a regulated entity and that is not a covered entity or business associate,associate. as such terms are defined in section 160.103 of title 45, Code of Federal Regulations (or any successor regulations).

(g) Regulations.--The Secretary may promulgate regulations to carry out this section.

17935(e)) or section 164.524(c)(3)(ii) of title 45, Code of Federal Regulations (or any successor regulations), in the case that an individual requests that a covered entity or any business associate of a covered entity transmit, produce, or provide access to a copy of the individual's protected health information toin aan person,electronic includinghealth anrecord entity,to a person designated by the individual, andthe exceptcovered whereentity permittedor withoutbusiness authorizationassociate undermay sectioncondition 164.506(c)the oftransmittal, titleproduction, 45,or Codeprovision of Federalaccess Regulationsupon (orthe anyperson successorto regulations)--whom (1) the individual'sinformation requestis shallto meetbe alltransmitted requirementsor ofproduced aor validto authorizationwhom underaccess sectionis 164.508(b)to ofbe titleprovided-- 45,(1) Codepaying offees, Federalin Regulationsaccordance (orwith anyapplicable successorState regulations);law and consistent with subsection (b), in advance of such transmittal, production, or access;

and (2) theacknowledging coveredand entityaccepting or business associate may condition the transmittal,terms, production,limitations, orand provisionconditions of accessuse uponand thedisclosure personcontained toin whom the informationrequest ismade toby bethe transmittedindividual oras producedthe orlegally tobinding whomobligation access is to be provided-- (A) paying fees, in accordance with applicable State law and consistent with subsection (b), in advance of suchthe transmittal,person production,receiving orthe access;information.

and(b) (B)Fees.--In acknowledgingapplying andsection accepting13405(e)(3) the terms, limitations, and conditions of use and disclosure contained in the requestHealth madeInformation byTechnology thefor individualEconomic asand theClinical legallyHealth bindingAct obligation(42 ofU.S.C. the person receiving the information.

(b)17935(e)(3)) Fees.--or (1)section In164.524(c)(4) general.--Inof applyingtitle 45, Code of Federal Regulations (or any successor regulations), each such section 13405(e)(3)shall apply only to the provision of access to, or the Healthproduction, Informationcopying, Technologyor fortransmittal Economicof, andprotected Clinicalhealth Healthinformation Actto-- (42(1) U.S.C.the individual, or the individual's personal representative;

17935(e)(3))(2) or section 164.524(c)(4) of title 45, Code of Federal Regulations (or any successor regulations), each such section shall apply only-- (A) to the provisionindividual's of access to, or the production, copying, or transmittal of, protected health informationcare directlyprovider to-- (i) the individual, or the individual'sbusiness personalassociates representative for health care purposes as described in section 164.502(g) of titlesuch 45,provider; Code of Federal Regulations (or any successor regulations);

(ii)or subject(3) toa paragraphpersonal (2)health andrecord sectionmanaged 164.510(b) of title 45, Code of Federal Regulations (or any successor regulation), any other person identified in, and subjectcontrolled toby the limitationsindividual. of, such section;

or(c) (iii)Definitions.--In this section-- (1) the individual'sterms health``business associate'', ``covered entity'', ``health care providerprovider'', or``individual'', ``person'', and ``protected health information'' have the businessmeanings associatesgiven such terms in section 160.103 of suchtitle provider;45, Code of Federal Regulations (or any successor regulations);

and (B)(2) as directed by the individual,term to``personal the electronic transmittal of the individual's electronic health recordrecord'' tohas the patientmeaning portalgiven orsuch mobileterm medicalin applicationsection used13400 andof maintained by the individual'sHealth healthInformation careTechnology provider or for theEconomic healthand careClinical providerHealth byAct its(42 businessU.S.C. associate.

(2)17921). Additional limitations.--In the case of the provision of access to, or the production, copying, or transmittal of, protected health information under paragraph (1)(A) directly to a person described in clause (ii) of such paragraph, such protected health information shall, in accordance with section 164.510(b) of title 45, Code of Federal Regulations (or any successor regulations), be limited to only such information that is-- (A) directly relevant to the person's involvement with the care of the individual or with the payment relevant to the care of the individual;

or (B) needed for notification purposes described in such section.

(c) Definitions.--In this section, the terms ``business associate'', ``covered entity'', ``health care provider'', ``individual'', ``person'', and ``protected health information'' have the meanings given such terms in section 160.103 of title 45, Code of Federal Regulations (or any successor regulations).

(e) Rules of Construction.--Nothing in this section shall be construed to-- (1) permit a covered entity or business associate to deny, delay, or condition a transmission directed by an individual in a manner that constitutes information blocking under section of the Public Health Service Act (42 U.S.C.

300jj-52) or part 171 of title 45, Code of Federal Regulations (or any successor regulations);

(2) treat an individual or the individual's personal representative who receives or accesses the individual's protected health information on the individual's behalf and at the direction of the individual as a person to whom a fee or condition may be applied under subsection (a), with respect to a personal health record that is selected, managed, and controlled by the individual or the individual's personal representative;

or (3) alter the rights or responsibilities of covered entities and individuals under section 13405(e) of the HITECH Act (42 U.S.C.

17935).

CONFIDENTIALITY OF RECORDS.

Section 543 of the Public Health Service Act (42 U.S.C.

290dd-2) is amended-- (1) in subsection (a), by striking ``subsection (b)'' and inserting ``the HIPAA regulations'';

(2) in subsection (b)-- (A) in paragraph (2), by redesignating subparagraphs (A) through (D) as paragraphs (1) through (4), respectively, and adjusting the margins accordingly;

and (B) by striking ``(b) Permitted Disclosure'' and all that follows through ``(2) Method for disclosure-- Whether'' and inserting the following:

``(b) Permitted Disclosure.--Whether'';

(3) in subsection (c), in the matter preceding paragraph (1), by striking ``subsection (b)(2)(C)'' and inserting ``subsection (b)(3)'';

and (4) in subsection (g), by striking ``subsection (b)(2)(C)'' and inserting ``subsection (b)(3)''.

SEC.

5.

NAS STUDY ON COMPENSATION TO PATIENTS FOR SHARING IDENTIFIABLE DATA FOR RESEARCH PURPOSES.

(a) In General.--Not later than 60 days after the date of enactment of this Act, the Secretary of Health and Human Services shall seek to enter into a contract with the National Academies of Sciences, Engineering, and Medicine to conduct a study examining potential risks and benefits of paying compensation to patients for sharing their identifiable data for research purposes.

(b) Inclusions.--The study conducted pursuant to the contract under subsection (a) shall include an examination of-- (1) the risks to patient privacy posed by the integration of identifiable, de-identified, and aggregated health information into datasets used for research;

(2) privacy enhancing tools and methods for the protection of patient health data;

(3) the feasibility of tracking patient data and consent for the integration of patient health data into datasets used for research;

(4) ethical considerations for compensating patients for use of their identifiable and de-identified health data;

(5) whether the existing exemptions permitting de- identified data to be used for research should consider whether a patient was given an opportunity to opt-in or opt-out of participation;

and (6) risk of re-identification of de-identified data.

SEC.

6.

PATIENT NOTIFICATION REQUIREMENTS UNDER THE HIPAA PRIVACY REGULATIONS.

(a) Patient Notification Upon Removal.--Any regulated entity or service provider who gains access to the protected health information of an individual through the patient right of access under section 164.524 of title 45, Code of Federal Regulations (or any successor regulations) shall-- (1) provide a written plain language notification to such individual prior to accessing such information-- (A) that such protected health information will no longer be subject to the protections under the HIPAA privacy regulation;

and (B) that includes an explanation of how and to which entities such protected health information may be redisclosed;

and (2) require the consent of the individual before selling such protected health information to third parties.

(b) Patient Notification Regarding Wellness Data.-- (1) In general.--Any regulated entity or service provider who offers digital technology that generates wellness data about individuals shall, with respect to each individual who uses such technology-- (A) provide a written plain language notification to the individual in advance of initiating the generation of such data that such data will not be subject to the protections of the HIPAA privacy regulation;

and (B) offer the individual an opportunity to opt out of such wellness data generation.

(2) Wellness data.--In this subsection, the term ``wellness data'' means data generated for the purpose of promoting health or preventing disease, which may include vital statistics, step counts, and medical regimen compliance.

(c) Definitions.--In this section-- (1) the terms ``business associate'', ``covered entity'', and ``protected health information'' have the meanings given such terms in section 160.103 of title 45, Code of Federal Regulations (or any successor regulations);

(2) the term ``HIPAA privacy regulation'' has the meaning given such term in section 1180(b)(3) of the Social Security Act (42 U.S.C.

1320d-9(b)(3));

and (3) the terms ``regulated entity'' and ``service provider'' have the meanings given such terms in section 2.

(d) Effective Date.--This section shall take effect beginning one year after the date of enactment of this Act.

SEC.

7.

Not(a) Rulemaking.--Not later than 1 year after the date of enactment of this Act, the Secretary of Health and Human Services (referred to in this section as the ``Secretary''), in coordination with the Commissioner of Food and Drugs and the National Coordinator for Health Information Technology, shall publishpromulgate guidanceregulations onregarding the application of the minimum necessary standard tounder datasection used164.502(b) forof artificialtitle intelligence45, andCode otherof machineFederal learningRegulations, applicationsto applicable health information and relevantprotected requirements,health information, including healthsuch datainformation interoperabilityused requirementsto undertrain, sectiondevelop, 3001(c)(9)validate, ofmodify, theor Publicoperate Healthan Serviceartificial Actintelligence (42or U.S.C.other machine learning model.

300jj-11(c)(9))(b) andContents.--The theregulations usepromulgated ofunder limitedsubsection data(a) setsshall-- pursuant(1) clarify that such minimum necessary standard does not permit a covered entity, business associate, regulated entity, or service provider to deny, delay, or condition a use or disclosure that is otherwise required or permitted, including a disclosure required under section 13405(b)3022 of the HITECHPublic Health Service Act (42 U.S.C.

17935(b)).300jj-52), on the ground that limiting the disclosure to the minimum necessary information is not technically feasible, and, as applicable, the minimum necessary standard is satisfied by reasonable efforts to limit the information used or disclosed, even where further technical limitation is not feasible;

(2) specify how the minimum necessary standard applies to the use of applicable health information and protected health information to develop, train, validate, or fine-tune an artificial intelligence or machine learning model, including the circumstances under which the use of a larger data set is reasonably necessary for such development, and the extent to which de-identification, data minimization, or privacy- enhancing technologies satisfy the standard;

and (3) address the minimum necessary standard with respect to the health data interoperability requirements under sections 3001(c)(9) and 3022 of the Public Health Service Act (42 U.S.C.

300jj-11(c)(9), 300jj-52) and part 171 of title 45, Code of Federal Regulations (or any successor regulations).

(c) Periodic Review.--The Secretary shall review, and update as appropriate, the regulations promulgated under subsection (a) not less frequently than once every 3 years.

8.5.

(b) Composition of Standards.--SuchStandards.--The standards under subsection (a) shall-- (1) be at least equivalentas toprotective oras exceed the de-de-identification identification standard specified in section 164.514(b)164.514(b)(1) of title 45, Code of Federal Regulations (or any successor regulations);regulations) (relating to expert determination), and may not permit information to be rendered de-identified information solely through the method specified in section 164.514(b)(2) of such title (relating to safe harbor);

and (3) specify that information shall not qualify as de- identified information when provided by a regulated entity, service provider, covered entity, or business associate to another person or entity unless such person or entity contractually agrees in writing not to re-identify or attempt to re-identify the information, and to require the same of any person or entity to whom such person or entity provides the information.information;

(c)and Definitions.--In(4) thisaccount section--for (1)evolving themethods termof ``applicablere-identification, healthincluding information''methods hasthat theuse meaningartificial givenintelligence suchor termmachine inlearning. section 2;

(c) Prohibition on Re-identification.--An entity that is the recipient of de-identified information may not re-identify, or attempt to re-identify, such information.

A violation of this subsection shall be enforceable and subject to the civil penalties under section 2(c).

(d) Definitions.--In this section-- (1) the term ``applicable health information'' has the meaning given such term in section 2;

and (3) the term ``privacy``privacy-enhancing enhancing technologies'' means any software or hardware solution, technical process, or other technological means of mitigating individuals' privacy risks arising from data processing by enhancing predictability, manageability, disassociability, and confidentiality.

9.6.

<all>Calendar No.

538 119th CONGRESS 2d Session S.

3097 _______________________________________________________________________ A BILL To provide additional protections with respect to health information, and for other purposes.

_______________________________________________________________________ August 4, 2026 Reported with an amendment