II 

116TH CONGRESS 

2D SESSION S. 5027 

To authorize the Director of the Centers for Disease Control and Prevention 

to award grants to eligible State, Tribal, and territorial public health 

agencies to develop and administer a program for digital contact tracing 

for COVID–19, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

DECEMBER 16, 2020 

Mr. SCHATZ (for himself and Ms. BALDWIN) introduced the following bill; 

which was read twice and referred to the Committee on Health, Education, Labor, and Pensions 

A BILL 

To authorize the Director of the Centers for Disease Control 

and Prevention to award grants to eligible State, Tribal, 

and territorial public health agencies to develop and administer a program for digital contact tracing for 

COVID–19, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Secure Data and Pri5 vacy for Contact Tracing Act of 2020’’. 

2 

•S 5027 IS

1 SEC. 2. GRANT PROGRAM FOR DIGITAL CONTACT TRACING 

2 FOR COVID–19. 

3 (a) IN GENERAL.—The Director of the Centers for 

4 Disease Control and Prevention shall award grants to eli5 gible State, Tribal, and territorial public health agencies 

6 to— 

7 (1) establish a contact tracing program that im8 plements traditional contact tracing protocols with 

9 the assistance of digital contact-tracing technology 

10 to track and prevent the spread of COVID–19; 

11 (2) incorporate digital contact-tracing tech12 nology into a contact tracing program that imple13 ments traditional contact tracing protocols to track 

14 and prevent the spread of COVID–19; and 

15 (3) expand or maintain an existing program as 

16 described in paragraph (1). 

17 (b) USE OF FUNDS.—Grant funding may be used for 

18 the development, maintenance, or staffing of digital con19 tact tracing programs, associated outreach and marketing, 

20 or other activities identified by a State, Tribal, or terri21 torial public health agency that advance the effectiveness 

22 and reach of digital contact-tracing technologies. 

23 (c) FUNDING DISQUALIFICATION.—If a State, Trib24 al, or territorial public health agency develops or procures 

25 any digital contact-tracing technology with respect to 

26 COVID–19 that does not meet each of the requirements 

3 

•S 5027 IS

1 listed in subsection (d), such State, Tribal, or territorial 

2 public health agency shall be ineligible to receive or con3 tinue to receive— 

4 (1) any funds through a grant under this sec5 tion; and 

6 (2) any other Federal funds, including under 

7 the CARES Act (Public Law 116–136), for any dig8 ital contact-tracing technology with respect to 

9 COVID–19. 

10 (d) DIGITAL CONTACT-TRACING REQUIREMENTS.— 

11 A State, Tribal, or territorial public health agency may 

12 use a grant under this section for digital contact-tracing 

13 technology, as described in subsections (a) and (b), only 

14 if the technology meets each of the following requirements: 

15 (1) The technology shall be voluntary for the 

16 user and provide to the user complete and clear in17 formation on the intended use and processing of 

18 data collected by the technology. To be voluntary for 

19 the user, the technology shall meet requirements in20 cluding each of the following: 

21 (A) Use of the technology and of contact22 tracing data collected using the technology shall 

23 be predicated on the user’s affirmative consent. 

4 

•S 5027 IS

1 (B) Use of the technology shall not be a 

2 condition for the reception of government bene3 fits. 

4 (C) Use of the technology shall not be 

5 made a condition of employment or employment 

6 status. 

7 (2) The technology shall limit the collection of 

8 data by the technology to only the data that is nec9 essary to meet contact tracing objectives, includ10 ing— 

11 (A) the status of any person as an infected 

12 or potentially infected person; and 

13 (B) the proximity of a person to someone 

14 who is symptomatic or has tested positive. 

15 (3) The technology— 

16 (A) shall delete or de-identify any contact17 tracing data that is individually identifiable in18 formation not later than the date that is 30 

19 days after the end of the COVID–19 emergency 

20 declaration; and 

21 (B) shall include notifications to prompt 

22 users to disable or completely remove any dig23 ital contact-tracing technology where practical. 

24 (4) The technology shall have robust contact 

25 detection specifications, including for distance and 

5 

•S 5027 IS

1 time, that allow for detection consistent with guid2 ance of the Centers for Disease Control and Preven3 tion on COVID–19. 

4 (5) The technology shall ensure that the storing 

5 of proximity and any contact-tracing data is 

6 encrypted to the maximum extent possible. 

7 (e) PLAN FOR INTEROPERABILITY.—As a condition 

8 on receipt of a grant under this section, a State, Tribal, 

9 or territorial public health agency shall— 

10 (1) develop and make publicly available a plan 

11 for how the digital contact-tracing technology of the 

12 agency with respect to COVID–19 augments— 

13 (A) traditional contact tracing efforts, if 

14 applicable; and 

15 (B) statewide efforts to prevent, prepare 

16 for, and respond to COVID–19; and 

17 (2) include in such plan a description of the 

18 agency’s efforts to ensure that the digital contact19 tracing technologies of the agency with respect to 

20 COVID–19 are interoperable with the digital con21 tact-tracing technology and public health agency 

22 databases of other jurisdictions with respect to 

23 COVID–19; and 

24 (3) ensure that data collected by the digital 

25 contact-tracing technology of the agency— 

6 

•S 5027 IS

1 (A) is accessed and processed only by pub2 lic health authorities (or their designees); and 

3 (B) is not shared with any person, or 

4 accessed or used by any person, for any purpose 

5 other than diagnosis, containment, treatment, 

6 or reduction of, or research into, COVID–19. 

7 (f) INDEPENDENT SECURITY ASSESSMENTS.— 

8 (1) IN GENERAL.—As a condition on receipt of 

9 a grant under this section, a State, Tribal, or terri10 torial public health agency shall— 

11 (A) establish procedures for completing or 

12 obtaining independent security assessments of 

13 digital contact tracing infrastructure to ensure 

14 that physical and network security is resilient 

15 and secure; and 

16 (B) develop a process to address the miti17 gation or remediation of the security 

18 vulnerabilities discovered during such inde19 pendent security assessments. 

20 (2) SOURCE CODE.—A State, Tribal, or terri21 torial public health agency should consider making 

22 public the source code of the digital contact-tracing 

23 technology used by the agency. 

24 (g) APPLICATION.—To seek a grant under this sec25 tion, an eligible State, Tribal, or territorial public health 

7 

•S 5027 IS

1 agency shall submit an application in such form, in such 

2 manner, and containing such information and assurances 

3 as the Director may require. 

4 (h) SECURING DIGITAL CONTACT-TRACING DATA.— 

5 (1) IN GENERAL.—The provisions of the 

6 HIPAA privacy and security law (as defined in sec7 tion 3009(a)(2) of the Public Health Service Act (42 

8 U.S.C. 300jj–19(a)(2))) shall apply to a State, Trib9 al, or territorial public health agency receiving a 

10 grant under subsection (a) with respect to individ11 ually identifiable health information (as defined in 

12 section 1171(a)(6) of the Social Security Act (42 

13 U.S.C. 1320d(a)(6))) received by, maintained on, or 

14 transmitted through a contact tracing program de15 scribed in such subsection (a) in the same manner 

16 as such provisions apply with respect to such infor17 mation and a covered entity (as defined in section 

18 13400(3) of the HITECH Act (42 U.S.C. 

19 17921(3))). 

20 (2) BUSINESS ASSOCIATES.— 

21 (A) IN GENERAL.—Any entity with a con22 tract in effect with an agency described in para23 graph (1) for the development, maintenance, or 

24 operation of a program described in such para25 graph shall be deemed to be a business assoVerDate Sep 11 2014 19:58 Jan 01, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S5027.IS S5027
8 

•S 5027 IS

1 ciate of such agency for purposes of subtitle D 

2 of the HITECH Act (42 U.S.C. 17921 et seq.). 

3 (B) REVISION OF SAMPLE AGREEMENT.— 

4 Not later than 180 days after the date of the 

5 enactment of this Act, the Secretary shall revise 

6 the sample business associate agreement provi7 sions published on January 25, 2013, to take 

8 account of the provisions of this subsection. 

9 (C) EFFECTIVE DATE.—The provisions of 

10 subparagraph (A) shall apply beginning on the 

11 day after the Secretary revises the provisions 

12 described in subparagraph (B). 

13 (i) LIMITATION ON USE OF DATA.—Data generated 

14 in connection with the operation of digital contact-tracing 

15 technology funded pursuant to this section may not be 

16 used for any punitive purpose, including law enforcement, 

17 immigration enforcement, or criminal prosecution. Such 

18 data and any information derived from it, whether in 

19 whole or in part, may not be received as evidence in any 

20 trial, hearing, or other proceeding in or before any court, 

21 grand jury, department, officer, agency, regulatory body, 

22 legislative committee, or other authority of the United 

23 States, a State, or a political subdivision thereof. 

9 

•S 5027 IS

1 (j) REPORT TO CONGRESS.—Not later than 24 

2 months after the date of enactment of this Act, the Comp3 troller General of the United States shall— 

4 (1) evaluate the outcome of the grants awarded 

5 under this section, including an assessment of the 

6 impact of the implementation of digital contact trac7 ing programs funded through such grants on the 

8 spread of COVID–19; and 

9 (2) submit to the Congress a report on the re10 sults of such evaluation. 

11 (k) DEFINITIONS.—In this section: 

12 (1) AFFIRMATIVE EXPRESS CONSENT.—The 

13 term ‘‘affirmative express consent’’ means an affirm14 ative act by an individual that clearly and conspicu15 ously communicates the individual’s authorization 

16 for an act or practice, in response to a specific re17 quest that— 

18 (A) is provided to the individual in a clear 

19 and conspicuous disclosure that is separate 

20 from other options or acceptance of general 

21 terms; 

22 (B) includes a description of each act or 

23 practice for which the individual’s consent is 

24 sought and— 

10 

•S 5027 IS

1 (i) is written clearly and unmistakably 

2 stated; and 

3 (ii) includes a prominent heading that 

4 would enable a reasonable individual to 

5 identify and understand the act or prac6 tice; and 

7 (C) cannot be inferred from inaction. 

8 (2) CONTACT-TRACING DATA.—The term ‘‘con9 tact-tracing data’’ means information linked or rea10 sonably linkable to a user or device, that— 

11 (A) concerns the COVID–19 pandemic; 

12 and 

13 (B) is gathered, processed, or transferred 

14 by digital contact-tracing technology. 

15 (3) COVID–19 EMERGENCY DECLARATION.— 

16 The term ‘‘COVID–19 emergency declaration’’ has 

17 the meaning given to such term in section 

18 1135(g)(1)(B) of the Social Security Act (42 U.S.C. 

19 1320b–5). 

20 (4) DE-IDENTIFY.—The term ‘‘de-identify’’ 

21 means to ensure that information cannot reasonably 

22 identify, relate to, describe, be capable of being asso23 ciated with, or be linked, directly or indirectly, to a 

24 particular individual. 

25 (5) DESIGNEE.—The term ‘‘designee’’— 

11 

•S 5027 IS

1 (A) subject to subparagraph (B), means 

2 any person or entity, other than a public health 

3 agency, that collects, processes, or transfers 

4 contact-tracing data in the course of performing 

5 a service or function on behalf of, for the ben6 efit of, under instruction of, and under contrac7 tual agreement with a public health authority; 

8 and 

9 (B) excludes any Federal, State, Tribal, 

10 territorial, or local law (including immigration 

11 law) enforcement personnel or entity. 

12 (6) DIGITAL CONTACT-TRACING TECH13 NOLOGY.— 

14 (A) IN GENERAL.—The term ‘‘digital con15 tact-tracing technology’’ means a website, on16 line application, mobile application, mobile oper17 ating system feature, or smart device applica18 tion that is designed, in part or in full, for the 

19 purpose of— 

20 (i) determining that a contact incident 

21 has occurred relating to the COVID–19 

22 pandemic; and 

23 (ii) taking consequent steps such as 

24 reporting the incident to a public health 

25 authority or user, or providing guidance or 

12 

•S 5027 IS

1 instructions to the user of the mobile de2 vice or the user’s household. 

3 (B) LIMITATIONS.—Such term does not in4 clude any technology to assist individuals to 

5 evaluate whether they are experiencing COVID– 

6 19 symptoms to the extent the technology is not 

7 used as described in subparagraph (A). 

8 (7) DIRECTOR.—The term ‘‘Director’’ means 

9 the Director of the Centers for Disease Control and 

10 Prevention. 

11 (8) MOBILE APPLICATION.—The term ‘‘mobile 

12 application’’ means a software program that runs on 

13 the operating system of a mobile device. 

14 (9) MOBILE DEVICE.—The term ‘‘mobile de15 vice’’ means a smartphone, tablet computer, or simi16 lar portable computing device that transmits data 

17 over a wireless connection. 

18 (10) SOURCE CODE.—The term ‘‘source code’’ 

19 is the programming instruction for a computer pro20 gram in its original form and saved in a file. 

21 (11) TRADITIONAL CONTACT TRACING.—The 

22 term ‘‘traditional contact tracing’’ means contact 

23 tracing by traditional means prior to contemporary 

24 digital contact tracing. 

13 

•S 5027 IS

1 (12) USER.—The term ‘‘user’’ means a member 

2 of the public who utilizes the software or hardware 

3 product. 

4 (l) AUTHORIZATION OF APPROPRIATIONS.—To carry 

5 out this section, there are authorized to be appropriated 

6 $75,000,000, to remain available until expended. 

Æ