II 

117TH CONGRESS 

2D SESSION S. 4738 

To protect the privacy of personally-identifiable health data, and for other 

purposes. 

IN THE SENATE OF THE UNITED STATES 

AUGUST 2, 2022 

Ms. KLOBUCHAR (for herself and Mr. WHITEHOUSE) introduced the following 

bill; which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To protect the privacy of personally-identifiable health data, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Stop Commercial Use 

5 of Health Data Act’’. 

6 SEC. 2. PRIVACY OF PERSONALLY-IDENTIFIABLE HEALTH 

7 DATA. 

8 (a) PROHIBITION ON THE USE OF PERSONALLY9 IDENTIFIABLE HEALTH DATA IN COMMERCIAL ADVER10 TISING.— 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•S 4738 IS

1 (1) IN GENERAL.—It shall be unlawful for any 

2 covered entity to use the personally-identifiable 

3 health data of an individual that is collected from 

4 any source (including data volunteered by an indi5 vidual, medical center-derived data, data from a 

6 wearable fitness tracker, data from web browsing 

7 history, or any other source determined appropriate 

8 by the Commission) for commercial advertising. 

9 (2) EXCEPTION FOR PUBLIC HEALTH CAM10 PAIGNS.—The prohibition under paragraph (1) shall 

11 not apply to any public health campaign directed to12 ward individuals or subpopulations of individuals. 

13 (b) RIGHT OF ACCESS AND DELETION.— 

14 (1) RIGHT OF ACCESS.— 

15 (A) IN GENERAL.—A covered entity shall 

16 make available an easy-to-use mechanism by 

17 which an individual, upon verified request, may 

18 access any personally-identifiable health data 

19 relating to such individual that is retained by 

20 such covered entity. 

21 (B) FORMAT.—A covered entity shall make 

22 the information described in subparagraph (A) 

23 available in both a human-readable and a ma24 chine-readable format. 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•S 4738 IS

1 (2) RIGHT OF DELETION.—A covered entity 

2 shall make available an easy-to-use mechanism by 

3 which an individual, upon verified request, may re4 quest the deletion of any personally-identifiable 

5 health data relating to such individual that is re6 tained by such covered entity. 

7 (3) REQUIREMENTS FOR ACCESS AND DELE8 TION.— 

9 (A) TIMELINE FOR COMPLYING WITH RE10 QUESTS.—A covered entity shall comply with a 

11 verified request received under this subsection 

12 without undue delay, but not later than 45 days 

13 after the date on which such covered entity re14 ceives such verified request. 

15 (B) FEES PROHIBITED.—A covered entity 

16 may not charge a fee to an individual for a re17 quest made under this subsection. 

18 (C) RULES OF CONSTRUCTION.—Nothing 

19 in this section shall be construed— 

20 (i) as supplanting or abrogating any 

21 provision of the Health Insurance Port22 ability and Accountability Act of 1996 

23 (Public Law 104–191); or 

24 (ii) to require a covered entity to— 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•S 4738 IS

1 (I) take an action that would 

2 convert information that is not per3 sonally-identifiable health data into 

4 personally-identifiable health data; 

5 (II) collect or retain personally6 identifiable health data that such cov7 ered entity would not otherwise collect 

8 or retain; or 

9 (III) retain personally-identifiable 

10 health data longer than such covered 

11 entity would otherwise retain such 

12 data. 

13 SEC. 3. ENFORCEMENT. 

14 (a) ENFORCEMENT BY THE COMMISSION.— 

15 (1) UNFAIR AND DECEPTIVE ACTS OR PRAC16 TICES.—A violation of section 2 or a regulation pro17 mulgated thereunder shall be treated as an unfair 

18 and deceptive act or practice proscribed under sec19 tion 5(a) of the Federal Trade Commission Act (15 

20 U.S.C. 45(a)). 

21 (2) POWERS OF THE COMMISSION.— 

22 (A) IN GENERAL.—The Commission shall 

23 enforce this Act in the same manner, by the 

24 same means, and with the same jurisdiction, 

25 powers, and duties as though all applicable 


pbinns on DSKJLVW7X2PROD with $$_JOB
5 

•S 4738 IS

1 terms and provisions of the Federal Trade 

2 Commission Act (15 U.S.C. 41 et seq.) were in3 corporated into and made a part of this Act. 

4 (B) PRIVILEGES AND IMMUNITIES.—Any 

5 person who violates this Act shall be subject to 

6 the penalties and entitled to the privileges and 

7 immunities provided in the Federal Trade Com8 mission Act (15 U.S.C. 41 et seq.). 

9 (C) AUTHORITY PRESERVED.—Nothing in 

10 this Act shall be construed to limit the author11 ity of the Commission under any other provi12 sion of law. 

13 (3) RULEMAKING.—The Commission shall pro14 mulgate in accordance with section 553 of title 5, 

15 United States Code, such rules as may be necessary 

16 to carry out this Act. 

17 (b) ENFORCEMENT BY INDIVIDUALS.— 

18 (1) IN GENERAL.—Any individual who suffers 

19 an injury (including the denial of a right established 

20 under this Act) as a result of a violation of this Act 

21 or a regulation promulgated thereunder by a covered 

22 entity may bring a civil action against such covered 

23 entity in Federal district court. 


pbinns on DSKJLVW7X2PROD with $$_JOB
6 

•S 4738 IS

1 (2) RELIEF.—In a civil action brought under 

2 paragraph (1) in which the plaintiff prevails, the 

3 court may award the plaintiff— 

4 (A) for a— 

5 (i) violation of section 2(a), an 

6 amount equal to the greater of— 

7 (I) $1,000 in statutory damages 

8 per commercial advertisement gen9 erated in violation of such subsection; 

10 or 

11 (II) the sum of any actual dam12 ages sustained; or 

13 (ii) violation of section 2(b), an 

14 amount equal to the sum of any actual 

15 damages sustained; and 

16 (B) reasonable attorney’s fees and litiga17 tion costs. 

18 SEC. 4. DEFINITIONS. 

19 (a) IN GENERAL.—In this Act: 

20 (1) COLLECT.—The term ‘‘collect’’ means, with 

21 respect to personally-identifiable health data, to ob22 tain such information in any manner. 

23 (2) COMMERCIAL ADVERTISING.—The term 

24 ‘‘commercial advertising’’ means communications 

25 that promote the sale of or interest in goods or servVerDate Sep 11 2014 20:44 Aug 06, 2022 Jkt 029200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S4738.IS S4738

pbinns on DSKJLVW7X2PROD with $$_JOB
7 

•S 4738 IS

1 ices, including goods or services that are published 

2 digitally, via video or audio, or in print. 

3 (3) COMMISSION.—The term ‘‘Commission’’ 

4 means the Federal Trade Commission. 

5 (4) COVERED ENTITY.—The term ‘‘covered en6 tity’’ means a person that— 

7 (A) is subject to the Federal Trade Com8 mission Act (15 U.S.C. 41 et seq.); and 

9 (B) collects, on an annual basis, the per10 sonally-identifiable health data of not less than 

11 1,000 individuals in the United States. 

12 (b) RULEMAKING.—Not later than 180 days after the 

13 date of enactment of this Act, the Commission shall con14 duct a rulemaking pursuant to section 553 of title 5, 

15 United States Code, to define the terms ‘‘public health 

16 campaign’’ and ‘‘personally-identifiable health data’’ for 

17 purposes of this Act. 

Æ 


pbinns on DSKJLVW7X2PROD with $$_JOB