II 

117TH CONGRESS 

1ST SESSION S. 24 

To protect the personal health data of all Americans. 

IN THE SENATE OF THE UNITED STATES 

JANUARY 22, 2021 

Ms. KLOBUCHAR (for herself and Ms. MURKOWSKI) introduced the following 

bill; which was read twice and referred to the Committee on Health, Education, Labor, and Pensions 

A BILL 

To protect the personal health data of all Americans. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Protecting Personal 

5 Health Data Act’’. 

6 SEC. 2. FINDINGS. 

7 Congress finds as follows: 

8 (1) On July 19, 2016, the Department of 

9 Health and Human Services, acting through the Of10 fice of the National Coordinator for Health Informa11 tion Technology and in coordination with the Office 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 24 IS

1 for Civil Rights of the Department of Health and 

2 Human Services and the Federal Trade Commission, 

3 issued a report to Congress entitled ‘‘Examining 

4 Oversight of the Privacy & Security of Health Data 

5 Collected by Entities Not Regulated by HIPAA’’ (re6 ferred to in this section as the ‘‘report’’) about the 

7 need to enact modern protections for consumers’ 

8 personal health data. 

9 (2) The report states that ‘‘[t]he wearable fit10 ness trackers, social media sites where individuals 

11 share health information through specific social net12 works, and other technologies that are common 

13 today did not exist when Congress enacted the 

14 Health Insurance Portability and Accountability Act 

15 of 1996’’. 

16 (3) The report states that entities not covered 

17 by the privacy protections of the Health Insurance 

18 Portability and Accountability Act of 1996 (Public 

19 Law 104–191), such as wearable fitness trackers 

20 and health-focused social media sites, ‘‘engage in a 

21 variety of practices such as online advertising and 

22 marketing, commercial uses or sale of individual in23 formation, and behavioral tracking practices, all of 

24 which indicate information use that is likely broader 

25 than what individuals would anticipate’’. 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 24 IS

1 (4) The report ‘‘identifies key gaps that exist 

2 between HIPAA regulated entities and those not 

3 regulated by HIPAA’’ and ‘‘recommends addressing 

4 those gaps in a way that protects consumers while 

5 leveling the playing field for innovators inside and 

6 outside of HIPAA’’. 

7 SEC. 3. DEFINITIONS. 

8 In this Act: 

9 (1) CONSUMER DEVICES, SERVICES, APPLICA10 TIONS, AND SOFTWARE.— 

11 (A) IN GENERAL.—Except as provided in 

12 subparagraph (C), the term ‘‘consumer devices, 

13 services, applications, and software’’ means de14 vices, services, applications, and software— 

15 (i) that are primarily designed for or 

16 marketed to consumers; and 

17 (ii) a substantial purpose or use of 

18 which is to collect or use personal health 

19 data. 

20 (B) INCLUSION.—The term ‘‘consumer de21 vices, services, applications, and software’’ shall 

22 include, but is not limited to— 

23 (i) direct-to-consumer genetic testing 

24 services; 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 24 IS

1 (ii) cloud-based or mobile technologies 

2 that are designed to collect individuals’ 

3 personal health data directly or indirectly 

4 with individuals’ consent, which could en5 able sharing of such information, such as 

6 wearable fitness trackers; and 

7 (iii) internet-based social media sites 

8 which are primarily designed for, or mar9 keted to, consumers to collect or use per10 sonal health data, including sites that 

11 share health conditions and experiences. 

12 (C) EXCEPTION.—The term ‘‘consumer de13 vices, services, applications, and software’’ shall 

14 not include— 

15 (i) products on which personal health 

16 data is derived solely from other informa17 tion that is not personal health data, such 

18 as Global Positioning System data; or 

19 (ii) products primarily designed for, or 

20 marketed to, covered entities and business 

21 associates (as defined for purposes of regu22 lations promulgated under section 264(c) 

23 of the Health Insurance Portability and 

24 Accountability Act of 1996 (42 U.S.C. 

25 1320d–2 note)). 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 24 IS

1 (2) DIRECT-TO-CONSUMER GENETIC TESTING

2 SERVICES.—The term ‘‘direct-to-consumer genetic 

3 testing service’’ means a service, which may include 

4 a test that analyzes various aspects of an individ5 ual’s genetic material, that enables a consumer to 

6 have access to their genetic information, or to infor7 mation derived therefrom, without the need to have 

8 a health care provider or health insurance issuer 

9 participate in the process of gaining access. 

10 (3) NATIONAL COORDINATOR.—The term ‘‘Na11 tional Coordinator’’ means the National Coordinator 

12 for Health Information Technology at the Depart13 ment of Health and Human Services. 

14 (4) OPERATOR.—The term ‘‘operator’’ means 

15 any person who operates any type of consumer de16 vices, services, applications, and software or who 

17 provides consumer devices, services, applications, 

18 and software for the use of consumers and collects 

19 or maintains personal health data from or about the 

20 users of such consumer devices, services, applica21 tions, and software. 

22 (5) PERSONAL HEALTH DATA.—The term ‘‘per23 sonal health data’’ means any information, including 

24 genetic information, whether oral or recorded in any 

25 form or medium, that relates to the past, present, or 


kjohnson on DSK79L0C42PROD with BILLS
6 

•S 24 IS

1 future physical or mental health or condition of an 

2 individual and that identifies the individual or with 

3 respect to which there is a reasonable basis to be4 lieve that the information can be used to identify the 

5 individual. 

6 (6) SECRETARY.—The term ‘‘Secretary’’ means 

7 the Secretary of Health and Human Services. 

8 SEC. 4. PROMULGATION OF REGULATIONS FOR OPERA9 TORS OF CONSUMER DEVICES, SERVICES, AP10 PLICATIONS, AND SOFTWARE. 

11 (a) IN GENERAL.—Not later than 6 months after the 

12 date on which the report is submitted under section 5(d), 

13 the Secretary, in consultation with the Chairman of the 

14 Federal Trade Commission, the National Coordinator, rel15 evant stakeholders, and heads of such other Federal agen16 cies as the Secretary considers appropriate, shall promul17 gate regulations to help strengthen privacy and security 

18 protections for consumers’ personal health data that is col19 lected, processed, analyzed, or used by consumer devices, 

20 services, applications, and software. 

21 (b) REQUIREMENTS.— 

22 (1) IN GENERAL.—The Secretary shall ensure 

23 that the regulations pursuant to subsection (a)— 

24 (A) account for differences in the nature 

25 and sensitivity of the data collected or stored on 


kjohnson on DSK79L0C42PROD with BILLS
7 

•S 24 IS

1 the consumer device, service, application, or 

2 software; and 

3 (B) include such definitions for relevant 

4 terms that are necessary to accomplish the 

5 goals of the regulations set forth in subsection 

6 (a). 

7 (2) REQUIREMENTS OF SECRETARY.—In the 

8 promulgation of regulations under subsection (a), 

9 the Secretary, to the extent practicable, shall— 

10 (A) consider the findings in the report 

11 issued by the Department of Health and 

12 Human Services to Congress entitled ‘‘Exam13 ining Oversight of the Privacy & Security of 

14 Health Data Collected by Entities Not Regu15 lated by HIPAA’’, including findings regarding 

16 individuals’ access rights, re-use of data by 

17 third parties, security standards applicable to 

18 data holders and users, confusion or ambiguity 

19 regarding terminology related to privacy and se20 curity protections, and the adequacy of collec21 tion, use, and disclosure limitations; 

22 (B) consider other regulations and guid23 ance issued by the Federal Trade Commission, 

24 and other regulations promulgated under sec25 tion 264(c) of the Health Insurance Portability 


kjohnson on DSK79L0C42PROD with BILLS
8 

•S 24 IS

1 and Accountability Act of 1996 (42 U.S.C. 

2 1320d–2 note), subtitle D of the Health Infor3 mation Technology for Economic and Clinical 

4 Health Act (42 U.S.C. 17921 et seq.), Genetic 

5 Information Nondiscrimination Act (Public Law 

6 110–233, 122 Stat. 881), the Common Rule as 

7 contained in part 46 of title 45, Code of Fed8 eral Regulations, and other related Acts; 

9 (C) consistent with paragraph (3), consider 

10 appropriate uniform standards for consent re11 lated to the handling of genetic data, biometric 

12 data, and personal health data; 

13 (D) consider exceptions to consent require14 ments under subparagraph (C) for purposes 

15 that may include law enforcement, academic re16 search or research for the sole purpose of as17 sessing health care utilization and outcomes, 

18 emergency medical treatment, or determining 

19 paternity; 

20 (E) consider appropriate minimum stand21 ards of security that may differ according to 

22 the nature and sensitivity of the data collected 

23 or stored on, or processed or transferred by, the 

24 consumer device, service, application, or soft25 ware; 


kjohnson on DSK79L0C42PROD with BILLS
9 

•S 24 IS

1 (F) consider appropriate standards for the 

2 de-identification of personal health data; 

3 (G) consider appropriate limitations on the 

4 collection, use, or disclosure of personal health 

5 data to that which is directly relevant and nec6 essary to accomplish a specified purpose; 

7 (H) consult with the National Coordinator, 

8 the Commissioner of Food and Drugs, and the 

9 Chairman of the Federal Trade Commission; 

10 and 

11 (I) provide for initial and ongoing outreach 

12 regarding regulations affecting industries, busi13 nesses, and individuals to ensure awareness of 

14 consumer privacy and security protections in 

15 the field of digital health technology. 

16 (3) UNIFORM STANDARDS.—In the review of 

17 each of the areas described in paragraph (2)(C), the 

18 Secretary shall consider— 

19 (A) the development of standards for ob20 taining user consent based on how information 

21 will be shared to ensure that prior to the collec22 tion, analysis, use, or disclosure of consumers’ 

23 personal health data, an operator of a consumer 

24 device, service, application, or software specifies 


kjohnson on DSK79L0C42PROD with BILLS
10 

•S 24 IS

1 the uses of the personal health data and who 

2 will have access to the information; 

3 (B) the manner in which consent is ob4 tained in a way that uses clear, concise, and 

5 well-organized language that is easily accessible, 

6 of reasonable length, at an appropriate level of 

7 readability, and clearly distinguishable from 

8 other matters; 

9 (C) a process to limit the transfer of per10 sonal health data to third parties and provide 

11 consumers with greater control over how their 

12 personal health data is used for marketing pur13 poses; 

14 (D) secondary uses outside of the primary 

15 purpose of the service as initially indicated 

16 when consent was first obtained; 

17 (E) a process to permit a withdrawal of 

18 consent to ensure that a user is able to remove 

19 consent for the terms of service for use of the 

20 consumer device, service, application, or soft21 ware, including the collection and use of per22 sonal health data as easily as the user is able 

23 to give such consent; 

24 (F) providing a right to access a copy of 

25 the personal health data that the operator has 


kjohnson on DSK79L0C42PROD with BILLS
11 

•S 24 IS

1 collected, analyzed, or used, free of charge and 

2 in an electronic and easily accessible format, in3 cluding a list of each entity that received the 

4 personal health data from the operator, whether 

5 through sale or other means; and 

6 (G) providing a right to delete and amend 

7 personal health data, to the extent practicable, 

8 that the operator has collected, analyzed, or 

9 used. 

10 (c) UPDATES.—The Secretary shall review and, if 

11 necessary, update the regulations promulgated under sub12 section (a) in accordance with the requirements under sub13 section (b). 

14 (d) PUBLIC AVAILABILITY.—The Department of 

15 Health and Human Services shall make prominently avail16 able to the public on the Department’s internet website, 

17 clear and concise information about available resources re18 lated to the regulations promulgated under subsection (a) 

19 and all updates to such resources. 

20 (e) CONSISTENCY OF RESOURCES PUBLISHED BY

21 FEDERAL AGENCIES.—If a Federal agency publishes re22 sources to help protect consumers’ personal health data, 

23 the head of such Federal agency, to the degree practicable, 

24 shall make such resources consistent with the regulations 

25 promulgated under subsection (a). 


kjohnson on DSK79L0C42PROD with BILLS
12 

•S 24 IS

1 (f) OTHER FEDERAL PRIVACY AND SECURITY RE2 QUIREMENTS.—Nothing in this section shall be construed 

3 to supersede, alter, or otherwise affect any privacy and 

4 security requirements enforced by Federal agencies. 

5 SEC. 5. NATIONAL TASK FORCE ON HEALTH DATA PROTEC6 TION. 

7 (a) ESTABLISHMENT.—The Secretary, in consulta8 tion with the Chairman of the Federal Trade Commission, 

9 the National Coordinator, and relevant stakeholders, shall 

10 establish a task force, to be known as the National Task 

11 Force on Health Data Protection (referred to in this sec12 tion as the ‘‘Task Force’’). 

13 (b) DUTIES.—The Task Force shall— 

14 (1) study the long-term effectiveness of de-iden15 tification methodologies for genetic data and biomet16 ric data; 

17 (2) evaluate and provide input on the develop18 ment of security standards, including encryption 

19 standards and transfer protocols, for consumer de20 vices, services, applications, and software; 

21 (3) evaluate and provide input with respect to 

22 addressing cybersecurity risks and security concerns 

23 related to consumer devices, services, applications, 

24 and software; 


kjohnson on DSK79L0C42PROD with BILLS
13 

•S 24 IS

1 (4) evaluate and provide input with respect to 

2 the privacy concerns and protection standards re3 lated to consumer and employee health data; 

4 (5) review and advise on the need, if any, to up5 date the report issued by the Department of Health 

6 and Human Services to Congress entitled ‘‘Exam7 ining Oversight of the Privacy & Security of Health 

8 Data Collected by Entities Not Regulated by 

9 HIPAA’’; and 

10 (6) provide advice and consultation in the es11 tablishment and dissemination of resources to edu12 cate and advise consumers about the basics of genet13 ics and direct-to-consumer genetic testing, and the 

14 risks, benefits, and limitations of such testing. 

15 (c) MEMBERS.—The Secretary, in consultation with 

16 the Chairman of the Federal Trade Commission, the Na17 tional Coordinator, and relevant stakeholders, shall ap18 point not more than 15 members to the Task Force. In 

19 appointing such members, the Secretary shall ensure that 

20 the total membership of the Task Force is an odd number 

21 and represents a diverse set of stakeholder perspectives. 

22 (d) REPORTING.—Not later than 1 year after the 

23 date of enactment of this Act, the Task Force shall pre24 pare and submit to the Committee on Commerce, Science, 

25 and Transportation of the Senate, the Committee on 


kjohnson on DSK79L0C42PROD with BILLS
14 

•S 24 IS

1 Health, Education, Labor, and Pensions of the Senate, the 

2 Committee on Homeland Security and Governmental Af3 fairs of the Senate, the Committee on Energy and Com4 merce of the House of Representatives, the Committee on 

5 Homeland Security of the House of Representatives, the 

6 Secretary, the Chairman of the Federal Trade Commis7 sion, and the Commissioner of Food and Drugs, a report 

8 on the findings of the Task Force. 

9 (e) AUTHORIZATION OF APPROPRIATIONS.—There 

10 are authorized to be appropriated such sums as may be 

11 necessary to carry out this section. 

12 (f) FEDERAL ADVISORY COMMITTEE ACT.—The 

13 Federal Advisory Committee Act (5 U.S.C. App.) shall 

14 apply to the Task Force. 

15 (g) SUNSET.— 

16 (1) IN GENERAL.—The Task Force shall termi17 nate on the date that is 5 years after the date of the 

18 first meeting of the Task Force. 

19 (2) RECOMMENDATION.—Not later than the 

20 date that is one year prior to the termination of the 

21 Task Force under paragraph (1), the Secretary shall 

22 submit to Congress a recommendation on whether 

23 the Task Force should be extended. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS