I 

116TH CONGRESS 

2D SESSION H. R. 7472 

To authorize the Director of the Centers for Disease Control and Prevention 

to award grants to eligible State, Tribal, and territorial public health 

agencies to develop and administer a program for digital contact tracing 

for COVID–19, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JULY 1, 2020 

Ms. SPEIER (for herself, Ms. DEGETTE, Mrs. DINGELL, Mr. CARSON of Indiana, Ms. BARRAGA ́N, Mr. LYNCH, Mr. RASKIN, Mr. SAN NICOLAS, Mr. 

TAKANO, and Mr. HASTINGS) introduced the following bill; which was referred to the Committee on Energy and Commerce 

A BILL 

To authorize the Director of the Centers for Disease Control 

and Prevention to award grants to eligible State, Tribal, 

and territorial public health agencies to develop and administer a program for digital contact tracing for 

COVID–19, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Secure Data and Pri5 vacy for Contact Tracing Act of 2020’’. 


pbinns on DSKJLVW7X2PROD with BILLS
2 

•HR 7472 IH

1 SEC. 2. GRANT PROGRAM FOR DIGITAL CONTACT TRACING 

2 FOR COVID–19. 

3 (a) IN GENERAL.—The Director of the Centers for 

4 Disease Control and Prevention shall award grants to eli5 gible State, Tribal, and territorial public health agencies 

6 to— 

7 (1) establish a contact-tracing program that im8 plements traditional contact tracing protocols with 

9 the assistance of digital contact tracing technology 

10 to track and prevent the spread of COVID–19; or 

11 (2) incorporate digital contact tracing tech12 nology into a contact-tracing program that imple13 ments traditional contact tracing protocols to track 

14 and prevent the spread of COVID–19. 

15 (b) FUNDING DISQUALIFICATION.—If a State, Trib16 al, or territorial public health agency develops or procures 

17 any digital contact tracing technology with respect to 

18 COVID–19 that does not meet each of the requirements 

19 listed in subsection (c), such State, Tribal, or territorial 

20 public health agency shall be ineligible to receive or con21 tinue to receive— 

22 (1) any funds through a grant under this sec23 tion; and 

24 (2) any other Federal funds, including under 

25 the CARES Act (Public Law 116–136), for any digVerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472

pbinns on DSKJLVW7X2PROD with BILLS
3 

•HR 7472 IH

1 ital contact-tracing technology with respect to 

2 COVID–19. 

3 (c) DIGITAL CONTACT-TRACING REQUIREMENTS.—A 

4 State, Tribal, or territorial public health agency may use 

5 a grant under this section for digital contact tracing tech6 nology, as described in subsection (a), only if the tech7 nology meets each of the following requirements: 

8 (1) The technology shall be voluntary for the 

9 user and provide to the user complete and clear in10 formation on the intended use and processing of 

11 data collected by the technology. To be voluntary for 

12 the user, the technology shall meet requirements in13 cluding each of the following: 

14 (A) Use of the technology and of contact15 tracing data collected using the technology shall 

16 be predicated on the user’s affirmative consent. 

17 (B) Use of the technology shall not be a 

18 condition for the reception of government bene19 fits. 

20 (C) Use of the technology shall not be 

21 made a condition of employment or employment 

22 status. 

23 (2) The technology shall limit the collection of 

24 data by the technology to only the data that is necVerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472

pbinns on DSKJLVW7X2PROD with BILLS
4 

•HR 7472 IH

1 essary to meet contact-tracing objectives, includ2 ing— 

3 (A) the status of any person as an infected 

4 or potentially infected person; and 

5 (B) the proximity of a person to someone 

6 who is symptomatic or has tested positive. 

7 (3) The technology— 

8 (A) shall delete or de-identify any contact9 tracing data that is individually identifiable in10 formation not later than the date that is 30 

11 days after the end of the COVID–19 emergency 

12 declaration; and 

13 (B) shall include notifications to prompt 

14 users to disable or completely remove any dig15 ital contact-tracing technology where practical. 

16 (4) The technology shall have robust contact 

17 detection specifications, including for distance and 

18 time, that allow for detection consistent with guid19 ance of the Centers for Disease Control and Preven20 tion on COVID–19. 

21 (5) The technology shall ensure that the storing 

22 of proximity and any contact-tracing data is 

23 encrypted to the maximum extent possible. 


pbinns on DSKJLVW7X2PROD with BILLS
5 

•HR 7472 IH

1 (d) PLAN FOR INTEROPERABILITY.—As a condition 

2 on receipt of a grant under this section, a State, Tribal, 

3 or territorial public health agency shall— 

4 (1) develop and make publicly available a plan 

5 for how the digital contact-tracing technology of the 

6 agency with respect to COVID–19 augments— 

7 (A) traditional contact tracing efforts, if 

8 applicable; and 

9 (B) statewide efforts to prevent, prepare 

10 for, and respond to COVID–19; and 

11 (2) include in such plan a description of the 

12 agency’s efforts to ensure that the digital contact13 tracing technologies of the agency with respect to 

14 COVID–19 are interoperable with the digital con15 tact-tracing technology and public health agency 

16 databases of other jurisdictions with respect to 

17 COVID–19; and 

18 (3) ensure that data collected by the digital 

19 contact-tracing technology of the agency— 

20 (A) is accessed and processed only by pub21 lic health authorities (or their designees); and 

22 (B) is not shared with any person, or 

23 accessed or used by any person, for any purpose 

24 other than diagnosis, containment, treatment, 

25 or reduction of, or research into, COVID–19. 


pbinns on DSKJLVW7X2PROD with BILLS
6 

•HR 7472 IH

1 (e) INDEPENDENT SECURITY ASSESSMENTS.— 

2 (1) IN GENERAL.—As a condition on receipt of 

3 a grant under this section, a State, Tribal, or terri4 torial public health agency shall— 

5 (A) establish procedures for completing or 

6 obtaining independent security assessments of 

7 digital contact-tracing infrastructure to ensure 

8 that physical and network security is resilient 

9 and secure; and 

10 (B) develop a process to address the miti11 gation or remediation of the security 

12 vulnerabilities discovered during such inde13 pendent security assessments. 

14 (2) SOURCE CODE.—A State, Tribal, or terri15 torial public health agency should consider making 

16 public the source code of the digital contact-tracing 

17 technology used by the agency. 

18 (f) APPLICATION.—To seek a grant under this sec19 tion, an eligible State, Tribal, or territorial public health 

20 agency shall submit an application in such form, in such 

21 manner, and containing such information and assurances 

22 as the Director may require. 

23 (g) SECURING DIGITAL CONTACT-TRACING DATA.— 

24 (1) IN GENERAL.—The provisions of the 

25 HIPAA privacy and security law (as defined in secVerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472

pbinns on DSKJLVW7X2PROD with BILLS
7 

•HR 7472 IH

1 tion 3009(a)(2) of the Public Health Service Act (42 

2 U.S.C. 300jj–19(a)(2))) shall apply to a State, Trib3 al, or territorial public health agency receiving a 

4 grant under subsection (a) with respect to individ5 ually identifiable health information (as defined in 

6 section 1171(a)(6) of the Social Security Act (42 

7 U.S.C. 1320d(a)(6))) received by, maintained on, or 

8 transmitted through a contact-tracing program de9 scribed in such subsection (a) in the same manner 

10 as such provisions apply with respect to such infor11 mation and a covered entity (as defined in section 

12 13400(3) of the HITECH Act (42 U.S.C. 

13 17921(3))). 

14 (2) BUSINESS ASSOCIATES.— 

15 (A) IN GENERAL.—Any entity with a con16 tract in effect with an agency described in para17 graph (1) for the development, maintenance, or 

18 operation of a program described in such para19 graph shall be deemed to be a business asso20 ciate of such agency for purposes of subtitle D 

21 of the HITECH Act (42 U.S.C. 17921 et seq.). 

22 (B) REVISION OF SAMPLE AGREEMENT.— 

23 Not later than 180 days after the date of the 

24 enactment of this Act, the Secretary shall revise 

25 the sample business associate agreement proviVerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472

pbinns on DSKJLVW7X2PROD with BILLS
8 

•HR 7472 IH

1 sions published on January 25, 2013, to take 

2 account of the provisions of this subsection. 

3 (C) EFFECTIVE DATE.—The provisions of 

4 subparagraph (A) shall apply beginning on the 

5 day after the Secretary revises the provisions 

6 described in subparagraph (B). 

7 (h) LIMITATION ON USE OF DATA.—Data generated 

8 in connection with the operation of digital contact tracing 

9 technology funded pursuant to this section may not be 

10 used for any punitive purpose, including law enforcement, 

11 immigration enforcement, or criminal prosecution. Such 

12 data and any information derived from it, whether in 

13 whole or in part, may not be received as evidence in any 

14 trial, hearing, or other proceeding in or before any court, 

15 grand jury, department, officer, agency, regulatory body, 

16 legislative committee, or other authority of the United 

17 States, a State, or a political subdivision thereof. 

18 (i) REPORT TO CONGRESS.—Not later than 90 days 

19 after the date of enactment of this Act, the Comptroller 

20 General of the United States shall— 

21 (1) evaluate the outcome of the grants awarded 

22 under this section, including an assessment of the 

23 impact of the implementation of digital contact-trac24 ing programs funded through such grants on the 

25 spread of COVID–19; and 


pbinns on DSKJLVW7X2PROD with BILLS
9 

•HR 7472 IH

1 (2) submit to the Congress a report on the re2 sults of such evaluation. 

3 (j) DEFINITIONS.—In this section: 

4 (1) AFFIRMATIVE EXPRESS CONSENT.—The 

5 term ‘‘affirmative express consent’’ means an affirm6 ative act by an individual that clearly and conspicu7 ously communicates the individual’s authorization 

8 for an act or practice, in response to a specific re9 quest that— 

10 (A) is provided to the individual in a clear 

11 and conspicuous disclosure that is separate 

12 from other options or acceptance of general 

13 terms; 

14 (B) includes a description of each act or 

15 practice for which the individual’s consent is 

16 sought and— 

17 (i) is written clearly and unmistakably 

18 stated; and 

19 (ii) includes a prominent heading that 

20 would enable a reasonable individual to 

21 identify and understand the act or prac22 tice; and 

23 (C) cannot be inferred from inaction. 


pbinns on DSKJLVW7X2PROD with BILLS
10 

•HR 7472 IH

1 (2) CONTACT-TRACING DATA.—The term ‘‘con2 tact-tracing data’’ means information linked or rea3 sonably linkable to a user or device, that— 

4 (A) concerns the COVID–19 pandemic; 

5 and 

6 (B) is gathered, processed, or transferred 

7 by digital contact tracing technology. 

8 (3) COVID–19 EMERGENCY DECLARATION.— 

9 The term ‘‘COVID–19 emergency declaration’’ has 

10 the meaning given to such term in section 

11 1135(g)(1)(B) of the Social Security Act (42 U.S.C. 

12 1320b–5). 

13 (4) DE-IDENTIFY.—The term ‘‘de-identify’’ 

14 means to ensure that information cannot reasonably 

15 identify, relate to, describe, be capable of being asso16 ciated with, or be linked, directly or indirectly, to a 

17 particular individual. 

18 (5) DESIGNEE.—The term ‘‘designee’’— 

19 (A) subject to subparagraph (B), means 

20 any person or entity, other than a public health 

21 agency, that collects, processes, or transfers 

22 contact-tracing data in the course of performing 

23 a service or function on behalf of, for the ben24 efit of, under instruction of, and under contracVerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472

pbinns on DSKJLVW7X2PROD with BILLS
11 

•HR 7472 IH

1 tual agreement with a public health authority; 

2 and 

3 (B) excludes any Federal, State, Tribal, 

4 territorial, or local law (including immigration 

5 law) enforcement personnel or entity. 

6 (6) DIGITAL CONTACT-TRACING TECH7 NOLOGY.— 

8 (A) IN GENERAL.—The term ‘‘digital con9 tact-tracing technology’’ means a website, on10 line application, mobile application, mobile oper11 ating system feature, or smart device applica12 tion that is designed, in part or in full, for the 

13 purpose of— 

14 (i) determining that a contact incident 

15 has occurred relating to the COVID–19 

16 pandemic; and 

17 (ii) taking consequent steps such as 

18 reporting the incident to a public health 

19 authority or user, or providing guidance or 

20 instructions to the user of the mobile de21 vice or the user’s household. 

22 (B) LIMITATIONS.—Such term does not in23 clude any technology to assist individuals to 

24 evaluate whether they are experiencing COVID– 


pbinns on DSKJLVW7X2PROD with BILLS
12 

•HR 7472 IH

1 19 symptoms to the extent the technology is not 

2 used as described in subparagraph (A). 

3 (7) DIRECTOR.—The term ‘‘Director’’ means 

4 the Director of the Centers for Disease Control and 

5 Prevention. 

6 (8) MOBILE APPLICATION.—The term ‘‘mobile 

7 application’’ means a software program that runs on 

8 the operating system of a mobile device. 

9 (9) MOBILE DEVICE.—The term ‘‘mobile de10 vice’’ means a smartphone, tablet computer, or simi11 lar portable computing device that transmits data 

12 over a wireless connection. 

13 (10) SOURCE CODE.—The term ‘‘source code’’ 

14 is the programming instruction for a computer pro15 gram in its original form and saved in a file. 

16 (11) TRADITIONAL CONTACT TRACING.—The 

17 term ‘‘traditional contact tracing’’ means contact 

18 tracing by traditional means prior to contemporary 

19 digital contact tracing. 

20 (12) USER.—The term ‘‘user’’ means a member 

21 of the public who utilizes the software or hardware 

22 product. 


pbinns on DSKJLVW7X2PROD with BILLS
13 

•HR 7472 IH

1 (k) AUTHORIZATION OF APPROPRIATIONS.—To carry 

2 out this section, there are authorized to be appropriated 

3 $75,000,000, to remain available until expended. 

Æ 


pbinns on DSKJLVW7X2PROD with BILLS