II 

118TH CONGRESS 

1ST SESSION S. 631 

To protect the privacy of personally identifiable health and location data, 

and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 2, 2023 

Ms. KLOBUCHAR (for herself, Ms. WARREN, and Ms. HIRONO) introduced the 

following bill; which was read twice and referred to the Committee on 

Commerce, Science, and Transportation 

A BILL 

To protect the privacy of personally identifiable health and 

location data, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Upholding Protections 

5 for Health and Online Location Data Privacy Act of 

6 2023’’ or the ‘‘UPHOLD Privacy Act of 2023’’. 

7 SEC. 2. PRIVACY OF HEALTH DATA. 

8 (a) PROHIBITION ON THE USE OF HEALTH DATA IN

9 COMMERCIAL ADVERTISING.—It shall be unlawful for any 

10 covered entity to use the health data of an individual that 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•S 631 IS

1 is collected from any source (including data volunteered 

2 by an individual, medical center-derived data, data from 

3 a wearable fitness tracker, data from web browsing his4 tory, or any other source determined appropriate by the 

5 Commission) for commercial advertising. 

6 (b) MINIMIZATION OF COLLECTING, RETAINING, 

7 USING, AND DISCLOSING HEALTH DATA.—A covered en8 tity may not collect, retain, use, or disclose health data 

9 except— 

10 (1) with the express consent of the individual to 

11 whom such data relates; or 

12 (2) as is strictly necessary to provide a product 

13 or service that the individual to whom such data re14 lates has requested from such covered entity. 

15 (c) MINIMIZATION OF EMPLOYEE ACCESS.—A cov16 ered entity shall restrict access to health data by any em17 ployee or service provider of the covered entity to only such 

18 an employee or service provider for which access is nec19 essary to provide a product or service that the individual 

20 to whom such data relates has requested from the covered 

21 entity. 

22 (d) PRIVACY POLICY.— 

23 (1) POLICY REQUIRED.—A covered entity shall 

24 maintain a privacy policy relating to the practices of 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•S 631 IS

1 such covered entity regarding the collecting, retain2 ing, using, and disclosing of health data. 

3 (2) PUBLICATION REQUIRED.—If a covered en4 tity has a website, such covered entity shall promi5 nently publish the privacy policy described in para6 graph (1) on such website. 

7 (3) CONTENTS.—The privacy policy described 

8 in paragraph (1) shall be clear and conspicuous and 

9 contain, at a minimum, the following: 

10 (A) A description of the practices of the 

11 covered entity regarding the collecting, retain12 ing, using, and disclosing of health data. 

13 (B) A clear and concise statement of the 

14 categories of such data collected, retained, used, 

15 or disclosed by the covered entity. 

16 (C) A clear and concise statement of the 

17 covered entity’s purposes for the collecting, re18 taining, using, or disclosing of such data. 

19 (D) A list of the specific third parties to 

20 which the covered entity discloses such data, 

21 and a clear and concise statement of the pur22 poses for which the covered entity discloses 

23 such data, including how the data may be used 

24 by each such third party. 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•S 631 IS

1 (E) A list of the specific third parties from 

2 which the covered entity has collected such 

3 data, and a clear and concise statement of the 

4 purposes for which the covered entity collects 

5 such data. 

6 (F) A clear and concise statement describ7 ing the extent to which an individual may exer8 cise control over the collecting, retaining, using, 

9 and disclosing of health data by the covered en10 tity, and the steps an individual must take to 

11 implement such controls. 

12 (G) A clear and concise statement describ13 ing the efforts of the covered entity to protect 

14 health data from unauthorized disclosure. 

15 SEC. 3. UNFAIR AND DECEPTIVE ACTS AND PRACTICES RE16 LATING TO LOCATION DATA. 

17 (a) PROHIBITION ON SALE FROM DATA BROKERS.— 

18 It shall be unlawful for a data broker to sell, resell, license, 

19 trade, transfer, share, or otherwise provide or make avail20 able location data (including data volunteered by an indi21 vidual, medical center-derived data, data from a wearable 

22 fitness tracker, data from web browsing history, or any 

23 other source determined appropriate by the Commission). 

24 (b) PROHIBITION ON SALE TO DATA BROKERS.—It 

25 shall be unlawful for any person to sell, resell, license, 


pbinns on DSKJLVW7X2PROD with $$_JOB
5 

•S 631 IS

1 trade, transfer, share, or otherwise provide or make avail2 able location data (including data volunteered by an indi3 vidual, medical center-derived data, data from a wearable 

4 fitness tracker, data from web browsing history, or any 

5 other source determined appropriate by the Commission) 

6 to a data broker. 

7 SEC. 4. RIGHT OF ACCESS AND DELETION. 

8 (a) RIGHT OF ACCESS.— 

9 (1) IN GENERAL.—A covered entity shall make 

10 available a reasonable mechanism by which an indi11 vidual, upon verified request, may access— 

12 (A) any health data or location data relat13 ing to such individual that is retained by such 

14 covered entity, including— 

15 (i) in the case of such data that the 

16 covered entity collected from any third 

17 party, how and from which specific third 

18 party the covered entity collected such 

19 data; and 

20 (ii) such data that the covered entity 

21 inferred about the individual; and 

22 (B) a list of the specific third parties to 

23 which the covered entity has disclosed any 

24 health data or location data relating to such in25 dividual. 


pbinns on DSKJLVW7X2PROD with $$_JOB
6 

•S 631 IS

1 (2) FORMAT.—A covered entity shall make the 

2 information described in paragraph (1) available in 

3 both a human-readable and a structured, interoper4 able, and machine-readable format. 

5 (b) RIGHT OF DELETION.—A covered entity shall 

6 make available a reasonable mechanism by which an indi7 vidual, upon verified request, may request the deletion of 

8 any health data or location data relating to such individual 

9 that is retained by the covered entity, including any such 

10 information that the covered entity collected from a third 

11 party or inferred from other information retained by the 

12 covered entity. 

13 (c) REQUIREMENTS FOR ACCESS AND DELETION.— 

14 (1) TIMELINE FOR COMPLYING WITH RE15 QUESTS.—A covered entity shall comply with a 

16 verified request received under this section without 

17 undue delay, but not later than 15 days after the 

18 date on which the covered entity receives such 

19 verified request. 

20 (2) FEES PROHIBITED.—A covered entity may 

21 not charge a fee to an individual for a request made 

22 under this section. 

23 (3) RULES OF CONSTRUCTION.—Nothing in 

24 this section shall be construed to require a covered 

25 entity to— 


pbinns on DSKJLVW7X2PROD with $$_JOB
7 

•S 631 IS

1 (A) take an action that would convert in2 formation that is not health data or location 

3 data into health data or location data; 

4 (B) collect or retain health data or location 

5 data that the covered entity would not other6 wise collect or retain; or 

7 (C) retain health data or location data 

8 longer than the covered entity would otherwise 

9 retain such data. 

10 (d) REASONABLE MECHANISM DEFINED.—In this 

11 section, the term ‘‘reasonable mechanism’’ means, with re12 spect to a covered entity and a right under this section, 

13 a mechanism that— 

14 (1) is equivalent in availability and ease of use 

15 to that of other mechanisms for communicating or 

16 interacting with the covered entity; and 

17 (2) includes an online means of exercising any 

18 such right. 

19 SEC. 5. EXCEPTIONS. 

20 (a) PUBLICATION OF NEWSWORTHY INFORMATION

21 OF LEGITIMATE PUBLIC CONCERN.—Nothing in this Act, 

22 or a regulation promulgated under this Act, shall apply 

23 with respect to health data or location data that is col24 lected, retained, used, or disclosed by a covered entity for 

25 the publication of newsworthy information of legitimate 


pbinns on DSKJLVW7X2PROD with $$_JOB
8 

•S 631 IS

1 public concern to the public, or to the collecting, retaining, 

2 using, or disclosing of such data by a covered entity for 

3 that purpose, if such covered entity has reasonable safe4 guards and processes that prevent the collecting, retain5 ing, using, or disclosing of health data or location data 

6 for commercial purposes other than the publication of 

7 newsworthy information of legitimate public concern. 

8 (b) PUBLIC HEALTH CAMPAIGNS.—The prohibition 

9 under section 2(a) shall not apply to any public health 

10 campaign directed toward individuals or subpopulations of 

11 individuals. 

12 (c) DISCLOSURE PURSUANT TO VALID AUTHORIZA13 TION.— 

14 (1) IN GENERAL.—Nothing in this Act shall be 

15 construed to prohibit a disclosure of the health data 

16 or location data of an individual for which the indi17 vidual provides valid authorization. 

18 (2) VALID AUTHORIZATION DEFINED.—For 

19 purposes of paragraph (1), the term ‘‘valid author20 ization’’ has the meaning given such term in section 

21 164.508 of title 45, Code of Federal Regulations (or 

22 a successor regulation), subject to any such adapta23 tion the Commission shall deem necessary to apply 

24 such term to the disclosure of both health data and 

25 location data. 


pbinns on DSKJLVW7X2PROD with $$_JOB
9 

•S 631 IS

1 (d) HIPAA-COMPLIANT ACTIONS.— 

2 (1) IN GENERAL.—Nothing in this Act shall be 

3 construed to prohibit any action taken with respect 

4 to the health information of an individual by a data 

5 broker that is a business associate or covered entity 

6 that is permissible under the Federal regulations 

7 concerning standards for privacy of individually 

8 identifiable health information promulgated under 

9 section 264(c) of the Health Insurance Portability 

10 and Accountability Act of 1996 (42 U.S.C. 1320d– 

11 2 note). 

12 (2) TERMS DEFINED.—For purposes of para13 graph (1), the terms ‘‘business associate’’, ‘‘covered 

14 entity’’, and ‘‘health information’’ shall have the 

15 meanings given those terms in the Federal regula16 tions specified in such section 264(c) of the Health 

17 Insurance Portability and Accountability Act of 

18 1996 (42 U.S.C. 1320d–2 note). 

19 SEC. 6. EFFECTIVE DATE. 

20 (a) IN GENERAL.—The prohibitions under sections 2 

21 and 3 shall take effect on the earlier of— 

22 (1) the date the Commission issues the final 

23 rule under subsection (b); or 

24 (2) 180 days after the date of enactment of this 

25 Act. 


pbinns on DSKJLVW7X2PROD with $$_JOB
10 

•S 631 IS

1 (b) RULEMAKING.— 

2 (1) FINAL RULE.—Not later than 180 days 

3 after the date of enactment of this Act, the Commis4 sion shall promulgate regulations, pursuant to sec5 tion 553 of title 5, United States Code, to carry out 

6 the provisions of this Act. 

7 (2) ADDITIONAL GUIDANCE.—The Commission 

8 may promulgate further regulations, pursuant to 

9 such section 553, to update and carry out the provi10 sions of this Act, including further guidance regard11 ing the types of data described in sections 2 and 3. 

12 SEC. 7. ENFORCEMENT. 

13 (a) ENFORCEMENT BY THE FEDERAL TRADE COM14 MISSION.— 

15 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC16 TICES.—A violation of section 2, 3, or 4 shall be 

17 treated as a violation of a rule defining an unfair or 

18 a deceptive act or practice under section 18(a)(1)(B) 

19 of the Federal Trade Commission Act (15 U.S.C. 

20 57a(a)(1)(B)). 

21 (2) POWERS OF THE COMMISSION.— 

22 (A) IN GENERAL.—Except as provided in 

23 subparagraphs (D) and (E), the Commission 

24 shall enforce this Act and any regulation pro25 mulgated thereunder in the same manner, by 


pbinns on DSKJLVW7X2PROD with $$_JOB
11 

•S 631 IS

1 the same means, and with the same jurisdic2 tion, powers, and duties as though all applicable 

3 terms and provisions of the Federal Trade 

4 Commission Act (15 U.S.C. 41 et seq.) were in5 corporated into and made a part of this Act. 

6 (B) PRIVILEGES AND IMMUNITIES.—Sub7 ject to subparagraph (F), any covered entity or 

8 data broker who violates this Act or any regula9 tion promulgated thereunder shall be subject to 

10 the penalties and entitled to the privileges and 

11 immunities provided in the Federal Trade Com12 mission Act (15 U.S.C. 41 et seq.). 

13 (C) AUTHORITY PRESERVED.—Nothing in 

14 this Act shall be construed to limit the author15 ity of the Federal Trade Commission under any 

16 other provision of law. 

17 (D) SCOPE OF JURISDICTION.—Notwith18 standing section 4, 5(a)(2), or 6 of the Federal 

19 Trade Commission Act (15 U.S.C. 44, 45(a)(2), 

20 46), or any jurisdictional limitation of the Com21 mission, the Commission shall also enforce this 

22 Act and the regulations promulgated under this 

23 Act, in the same manner provided in subpara24 graph (A), with respect to— 


pbinns on DSKJLVW7X2PROD with $$_JOB
12 

•S 631 IS

1 (i) common carriers subject to the 

2 Communications Act of 1934 (47 U.S.C. 

3 151 et seq.) and Acts amendatory thereof 

4 and supplementary thereto; and 

5 (ii) organizations that are not orga6 nized to carry on business for their own 

7 profit or that of their members. 

8 (E) INDEPENDENT LITIGATION AUTHOR9 ITY.—In any case in which the Commission has 

10 reason to believe that a covered entity or data 

11 broker is violating or has violated section 2, 3, 

12 or 4, the Commission may bring a civil action, 

13 subject to subsection (c), to— 

14 (i) enjoin any further such violation 

15 by such covered entity or data broker; 

16 (ii) enforce compliance with this Act, 

17 including through deletion of the relevant 

18 information; 

19 (iii) obtain a permanent, temporary, 

20 or preliminary injunction; 

21 (iv) obtain civil penalties; 

22 (v) obtain damages (whether actual, 

23 punitive, or otherwise), restitution, 

24 disgorgement of unjust enrichment, or 


pbinns on DSKJLVW7X2PROD with $$_JOB
13 

•S 631 IS

1 other compensation on behalf of aggrieved 

2 persons; or 

3 (vi) obtain any other appropriate equi4 table relief. 

5 (F) CIVIL PENALTIES.—In addition to any 

6 other penalties as may be prescribed by law, a 

7 violation of this Act shall carry a civil penalty 

8 not to exceed 15 percent of the revenues earned 

9 during the preceding 12-month period by the 

10 ultimate parent entity of the covered entity or 

11 data broker that committed such violation. 

12 (b) PRIVATE RIGHT OF ACTION.— 

13 (1) IN GENERAL.—Any individual alleging a 

14 violation of this Act or a regulation promulgated 

15 thereunder may bring a civil action, subject to sub16 section (c). 

17 (2) RELIEF.—In a civil action brought under 

18 paragraph (1) in which the plaintiff prevails, the 

19 court may award— 

20 (A) damages in an amount equal to the 

21 greater of— 

22 (i) actual damages; or 

23 (ii) an amount equal to not less than 

24 $100 and not more than $1,000 per viola25 tion, per day; 


pbinns on DSKJLVW7X2PROD with $$_JOB
14 

•S 631 IS

1 (B) punitive damages; 

2 (C) restitution or other compensation; 

3 (D) reasonable attorney’s fees, including 

4 litigation expenses, and costs; and 

5 (E) any other relief determined appro6 priate by the court, including equitable or de7 claratory relief. 

8 (3) INJURY IN FACT.—A violation of this Act or 

9 a regulation promulgated thereunder with respect to 

10 health data or location data constitutes a concrete 

11 and particularized injury in fact to the individual to 

12 whom such data relates. 

13 (4) INVALIDITY OF PRE-DISPUTE ARBITRATION

14 AGREEMENTS AND PRE-DISPUTE JOINT-ACTION

15 WAIVERS.— 

16 (A) IN GENERAL.—Notwithstanding any 

17 other provision of law, no pre-dispute arbitra18 tion agreement or pre-dispute joint-action waiv19 er shall be valid or enforceable with respect to 

20 a dispute arising under this Act. 

21 (B) APPLICABILITY.—Any determination 

22 as to whether or how this paragraph applies to 

23 any dispute shall be made by a court, rather 

24 than an arbitrator, without regard to whether 


pbinns on DSKJLVW7X2PROD with $$_JOB
15 

•S 631 IS

1 such agreement purports to delegate such deter2 mination to an arbitrator. 

3 (C) DEFINITIONS.—For purposes of this 

4 paragraph: 

5 (i) PRE-DISPUTE ARBITRATION

6 AGREEMENT.—The term ‘‘pre-dispute arbi7 tration agreement’’ means any agreement 

8 to arbitrate a dispute that has not arisen 

9 at the time of the making of the agree10 ment. 

11 (ii) PRE-DISPUTE JOINT-ACTION

12 WAIVER.—The term ‘‘pre-dispute joint-ac13 tion waiver’’ means an agreement that 

14 would prohibit a party from participating 

15 in a joint, class, or collective action in a ju16 dicial, arbitral, administrative, or other 

17 forum, concerning a dispute that has not 

18 yet arisen at the time of the making of the 

19 agreement. 

20 (c) EXCLUSIVE JURISDICTION.— 

21 (1) DISTRICT COURTS.—For any action brought 

22 under this Act, the following district courts shall 

23 have exclusive jurisdiction: 


pbinns on DSKJLVW7X2PROD with $$_JOB
16 

•S 631 IS

1 (A) COMMISSION.—For actions brought by 

2 the Commission, the United States District 

3 Court for the District of Columbia. 

4 (B) PRIVATE ACTIONS.—For private ac5 tions brought by individuals, in the court of the 

6 plaintiff’s choice between— 

7 (i) the United States District Court 

8 for the District of Columbia; or 

9 (ii) the district court of the United 

10 States for the judicial district in which the 

11 violation took place or in which any de12 fendant resides or does business. 

13 (2) COURT OF APPEALS.—The United States 

14 Court of Appeals for the District of Columbia Cir15 cuit shall have exclusive jurisdiction of appeals from 

16 any decision under paragraph (1). 

17 (d) STATUTE OF LIMITATIONS.—An action for a vio18 lation of this Act may be commenced not later than 6 

19 years after the date upon which the plaintiff obtains actual 

20 knowledge of the facts giving rise to such violation. 

21 SEC. 8. DEFINITIONS. 

22 (a) IN GENERAL.—In this Act: 

23 (1) COLLECT.—The term ‘‘collect’’ means, with 

24 respect to health data or location data, to obtain 

25 such data in any manner. 


pbinns on DSKJLVW7X2PROD with $$_JOB
17 

•S 631 IS

1 (2) COMMERCIAL ADVERTISING.—The term 

2 ‘‘commercial advertising’’ means communications 

3 that promote the sale of or interest in goods or serv4 ices, including goods or services that are published 

5 digitally, via video or audio, or in print. 

6 (3) COMMISSION.—The term ‘‘Commission’’ 

7 means the Federal Trade Commission. 

8 (4) COVERED ENTITY.— 

9 (A) IN GENERAL.—The term ‘‘covered en10 tity’’ means any entity that— 

11 (i) is engaged in activities in or affect12 ing commerce (as defined in section 4 of 

13 the Federal Trade Commission Act (15 

14 U.S.C. 44)); and 

15 (ii) is— 

16 (I) a person, partnership, or cor17 poration subject to the jurisdiction of 

18 the Commission under section 5(a)(2) 

19 of the Federal Trade Commission Act 

20 (15 U.S.C. 45(a)(2)); or 

21 (II) notwithstanding section 4, 

22 5(a)(2), or 6 of the Federal Trade 

23 Commission Act (15 U.S.C. 44, 

24 45(a)(2), 46) or any jurisdictional 

25 limitation of the Commission— 


pbinns on DSKJLVW7X2PROD with $$_JOB
18 

•S 631 IS

1 (aa) a common carrier sub2 ject to the Communications Act 

3 of 1934 (47 U.S.C. 151 et seq.) 

4 and all Acts amendatory thereof 

5 and supplementary thereto; or 

6 (bb) an organization not or7 ganized to carry on business for 

8 its own profit or that of its mem9 bers. 

10 (B) EXCLUSIONS.—The term ‘‘covered en11 tity’’ does not include an entity that is— 

12 (i) a covered entity, as defined in sec13 tion 160.103 of title 45, Code of Federal 

14 Regulations (or a successor regulation), to 

15 the extent such entity is acting as a cov16 ered entity under the HIPAA privacy regu17 lations (as defined in section 1180(b)(3) of 

18 the Social Security Act (42 U.S.C. 1320d– 

19 9(b)(3))); 

20 (ii) an entity that is a business asso21 ciate, as defined in section 160.103 of title 

22 45, Code of Federal Regulations (or a suc23 cessor regulation), to the extent such enti24 ty is acting as a business associate under 


pbinns on DSKJLVW7X2PROD with $$_JOB
19 

•S 631 IS

1 the HIPAA privacy regulations (as defined 

2 in such section 1180(b)(3)); or 

3 (iii) an entity that is subject to re4 strictions on disclosure of records under 

5 section 543 of the Public Health Service 

6 Act (42 U.S.C. 290dd–2), to the extent 

7 such entity is acting in a capacity subject 

8 to such restrictions. 

9 (5) DATA BROKER.—The term ‘‘data broker’’ 

10 means an individual or entity that— 

11 (A) collects, buys, licenses, or infers data 

12 about an individual; and 

13 (B) sells, licenses, or trades such data. 

14 (6) DISCLOSE.—The term ‘‘disclose’’ means, 

15 with respect to health data or location data, for a 

16 covered entity to release, transfer, sell, provide ac17 cess to, license, or divulge such data in any manner 

18 to a third party or government entity. 

19 (7) EXPRESS CONSENT.— 

20 (A) IN GENERAL.—The term ‘‘express con21 sent’’ means, with respect to the collecting, re22 taining, using, or disclosing of health data or 

23 location data, the informed, opted-in, voluntary, 

24 specific, and unambiguous written consent of an 

25 individual (which may include written consent 


pbinns on DSKJLVW7X2PROD with $$_JOB
20 

•S 631 IS

1 provided by electronic means) to such collecting, 

2 retaining, using, or disclosing of such data. 

3 (B) EXCLUSIONS.—The term ‘‘express 

4 consent’’ does not include any of the following: 

5 (i) Consent secured without first pro6 viding to the individual a clear and con7 spicuous disclosure, apart from any privacy 

8 policy, terms of service, terms of use, gen9 eral release, user agreement, or other simi10 lar document, of all information material 

11 to the provision of consent. 

12 (ii) Hovering over, muting, pausing, 

13 or exiting a given piece of content. 

14 (iii) Agreement obtained through the 

15 use of a user interface designed or manipu16 lated with the substantial effect of sub17 verting or impairing user autonomy, deci18 sion making, or choice. 

19 (8) HEALTH DATA.—The term ‘‘health data’’ 

20 means data that identifies, relates to, describes, or 

21 reveals— 

22 (A) the search for, attempt to obtain, or 

23 receipt of any health services; 

24 (B) any past, present, or future disability, 

25 physical health condition, mental health condiVerDate Sep 11 2014 21:31 Mar 15, 2023 Jkt 039200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6201 E:\BILLS\S631.IS S631

pbinns on DSKJLVW7X2PROD with $$_JOB
21 

•S 631 IS

1 tion, or health condition of an individual, in2 cluding efforts to research or obtain health 

3 services or supplies (including location data 

4 that might indicate an attempt to acquire or re5 ceive such information services or supplies); 

6 (C) any treatment or diagnosis of a dis7 ability or condition described in subparagraph 

8 (B); or 

9 (D) any information described in subpara10 graph (A) through subparagraph (C) that is de11 rived or extrapolated from non-health informa12 tion (such as proxy, derivative, inferred, emer13 gent, or algorithmic data). 

14 (9) LOCATION DATA.— 

15 (A) IN GENERAL.—The term ‘‘location 

16 data’’ means data derived from a device or 

17 technology that reveals the past or present 

18 physical location of an individual or device with 

19 sufficient precision to identify street-level loca20 tion information of the individual or device 

21 within 1,850 feet or less. 

22 (B) EXCLUSION.—The term ‘‘location 

23 data’’ does not include geolocation information 

24 identifiable or derived solely from the visual 

25 content of a legally obtained image, including 


pbinns on DSKJLVW7X2PROD with $$_JOB
22 

•S 631 IS

1 the location of the device that captured such 

2 image. 

3 (10) SERVICE PROVIDER.— 

4 (A) IN GENERAL.—The term ‘‘service pro5 vider’’ means an individual or entity that— 

6 (i) collects, retains, uses, or discloses 

7 health data for the sole purpose of, and 

8 only to the extent that such individual or 

9 entity is, conducting business activities on 

10 behalf of, for the benefit of, under instruc11 tion of, or under contractual agreement 

12 with a covered entity and not any other in13 dividual or entity; and 

14 (ii) does not divulge health data to 

15 any individual or entity other than such 

16 covered entity or a contractor to such serv17 ice provider bound to information proc18 essing terms no less restrictive than terms 

19 to which such service provider is bound. 

20 (B) LIMITATION OF APPLICATION.—Such 

21 individual or entity shall only be considered a 

22 service provider in the course of activities de23 scribed in subparagraph (A)(i). 

24 (C) MINIMIZATION BY SERVICE PRO25 VIDERS.—For purposes of section 2, a request 


pbinns on DSKJLVW7X2PROD with $$_JOB
23 

•S 631 IS

1 from an individual to a covered entity for a 

2 product or service, and an express consent from 

3 the individual to the covered entity, shall be 

4 treated as having also been provided to the 

5 service provider of the covered entity. 

6 (11) STATE.—The term ‘‘State’’ means each of 

7 the several States, the District of Columbia, each 

8 commonwealth, territory, or possession of the United 

9 States, and each Federally recognized Indian Tribe. 

10 (12) THIRD PARTY.—The term ‘‘third party’’ 

11 means, with respect to the disclosing or collecting of 

12 health data, any individual or entity that is not— 

13 (A) the covered entity that is disclosing or 

14 collecting such information; 

15 (B) the individual to whom such informa16 tion relates; or 

17 (C) a service provider. 

18 (13) ULTIMATE PARENT ENTITY.—The term 

19 ‘‘ultimate parent entity’’ has the meaning given the 

20 term in section 801.1 of title 16, Code of Federal 

21 Regulations (or a successor regulation). 

22 (b) RULEMAKING.— 

23 (1) IN GENERAL.—Not later than 180 days 

24 after the date of enactment of this Act, the Commis25 sion shall conduct a rulemaking pursuant to section 


pbinns on DSKJLVW7X2PROD with $$_JOB
24 

•S 631 IS

1 553 of title 5, United States Code, to define the 

2 terms ‘‘public health campaign’’ and ‘‘data’’ for pur3 poses of implementing and enforcing this Act. 

4 (2) REQUIREMENT.—For purposes of the rule5 making required under paragraph (1), the term 

6 ‘‘data’’ shall include information that is linked, or 

7 reasonably linkable, to— 

8 (A) specific individuals; or 

9 (B) specific groups of individuals who 

10 share the same place of residence or internet 

11 protocol address. 

12 SEC. 9. RELATIONSHIP TO FEDERAL AND STATE LAWS. 

13 (a) FEDERAL LAW PRESERVATION.—Nothing in this 

14 Act, or a regulation promulgated under this Act, shall be 

15 construed to limit any other provision of Federal law, ex16 cept as specifically provided in this Act. 

17 (b) STATE LAW PRESERVATION.— 

18 (1) IN GENERAL.—Nothing in this Act, or a 

19 regulation promulgated under this Act, shall be con20 strued to preempt, displace, or supplant any State 

21 law, except to the extent that a provision of State 

22 law conflicts with a provision of this Act, or a regu23 lation promulgated under this Act, and then only to 

24 the extent of the conflict. 


pbinns on DSKJLVW7X2PROD with $$_JOB
25 

•S 631 IS

1 (2) GREATER PROTECTION UNDER STATE

2 LAW.—For purposes of this subsection, a provision 

3 of State law does not conflict with a provision of this 

4 Act, or a regulation promulgated under this Act, if 

5 such provision of State law provides greater privacy 

6 protection than the privacy protection provided by 

7 such provision of this Act or such regulation. 

8 SEC. 10. SEVERABILITY CLAUSE. 

9 If any provision of this Act, or the application thereof 

10 to any individual, entity, or circumstance, is held invalid, 

11 the remainder of this Act, and the application of such pro12 vision to other persons not similarly situated or to other 

13 circumstances, shall not be affected by the invalidation. 

Æ 


pbinns on DSKJLVW7X2PROD with $$_JOB