I 

117TH CONGRESS 

1ST SESSION H. R. 651 

To protect the privacy of health information during a national health 

emergency. 

IN THE HOUSE OF REPRESENTATIVES 

FEBRUARY 1, 2021 

Ms. ESHOO (for herself, Ms. SCHAKOWSKY, Ms. DELBENE, Mr. BEYER, Mr. 

MCNERNEY, Ms. BARRAGA ́N, Mr. POCAN, Mr. RUSH, Mr. WELCH, Ms. 

SCANLON, Ms. MATSUI, Mr. LIEU, Mr. DESAULNIER, Mrs. HAYES, Mr. 

KHANNA, Mr. GARCI ́A of Illinois, Mr. LYNCH, Mr. GRIJALVA, Ms. LEE

of California, Mrs. DINGELL, Mr. DEFAZIO, Mr. JOHNSON of Georgia, 

and Ms. PORTER) introduced the following bill; which was referred to the 

Committee on Energy and Commerce 

A BILL 

To protect the privacy of health information during a 

national health emergency. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Public Health Emer5 gency Privacy Act’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act: 


pbinns on DSKJLVW7X2PROD with BILLS
2 

•HR 651 IH

1 (1) AFFIRMATIVE EXPRESS CONSENT.—The 

2 term ‘‘affirmative express consent’’ means an affirm3 ative act by an individual that— 

4 (A) clearly and conspicuously commu5 nicates the individual’s authorization of an act 

6 or practice; 

7 (B) is made in the absence of any mecha8 nism in the user interface that has the purpose 

9 or substantial effect of obscuring, subverting, or 

10 impairing decision making or choice to obtain 

11 consent; and 

12 (C) cannot be inferred from inaction. 

13 (2) COLLECT.—The term ‘‘collect’’, with re14 spect to emergency health data, means obtaining in 

15 any manner by a covered organization. 

16 (3) COMMISSION.—The term ‘‘Commission’’ 

17 means the Federal Trade Commission. 

18 (4) COVERED ORGANIZATION.— 

19 (A) IN GENERAL.—The term ‘‘covered or20 ganization’’ means any person (including a gov21 ernment entity)— 

22 (i) that collects, uses, or discloses 

23 emergency health data electronically or 

24 through communication by wire or radio; 

25 or 


pbinns on DSKJLVW7X2PROD with BILLS
3 

•HR 651 IH

1 (ii) that develops or operates a 

2 website, web application, mobile applica3 tion, mobile operating system feature, or 

4 smart device application for the purpose of 

5 tracking, screening, monitoring, contact 

6 tracing, or mitigation, or otherwise re7 sponding to the COVID–19 public health 

8 emergency. 

9 (B) EXCLUSIONS.—The term ‘‘covered or10 ganization’’ does not include— 

11 (i) a health care provider; 

12 (ii) a person engaged in a de minimis 

13 collection or processing of emergency 

14 health data; 

15 (iii) a service provider; 

16 (iv) a person acting in their individual 

17 or household capacity; or 

18 (v) a public health authority. 

19 (5) DEMOGRAPHIC DATA.—The term ‘‘demo20 graphic data’’ means information relating to the ac21 tual or perceived race, color, ethnicity, national ori22 gin, religion, sex, gender, gender identity, sexual ori23 entation, age, Tribal affiliation, disability, domicile, 

24 employment status, familial status, immigration staVerDate Sep 11 2014 04:15 Mar 19, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H651.IH H651

pbinns on DSKJLVW7X2PROD with BILLS
4 

•HR 651 IH

1 tus, or veteran status of an individual or group of 

2 individuals. 

3 (6) DEVICE.—The term ‘‘device’’ means any 

4 electronic equipment that is primarily designed for 

5 or marketed to consumers. 

6 (7) DISCLOSURE.—The term ‘‘disclosure’’, with 

7 respect to emergency health data, means the releas8 ing, transferring, selling, providing access to, licens9 ing, or divulging in any manner by a covered organi10 zation to a third party. 

11 (8) EMERGENCY HEALTH DATA.—The term 

12 ‘‘emergency health data’’ means data linked or rea13 sonably linkable to an individual or device, including 

14 data inferred or derived about the individual or de15 vice from other collected data provided such data is 

16 still linked or reasonably linkable to the individual or 

17 device, that concerns the public COVID–19 health 

18 emergency. Such data includes— 

19 (A) information that reveals the past, 

20 present, or future physical or behavioral health 

21 or condition of, or provision of healthcare to, an 

22 individual, including— 

23 (i) data derived from the testing or 

24 examination of a body part or bodily sub25 stance, or a request for such testing; 


pbinns on DSKJLVW7X2PROD with BILLS
5 

•HR 651 IH

1 (ii) whether or not an individual has 

2 contracted or been tested for, or an esti3 mate of the likelihood that a particular in4 dividual may contract, such disease or dis5 order; and 

6 (iii) genetic data, biological samples, 

7 and biometrics; and 

8 (B) other data collected in conjunction 

9 with other emergency health data or for the 

10 purpose of tracking, screening, monitoring, con11 tact tracing, or mitigation, or otherwise re12 sponding to the COVID–19 public health emer13 gency, including— 

14 (i) geolocation data, when such term 

15 means data capable of determining the 

16 past or present precise physical location of 

17 an individual at a specific point in time, 

18 taking account of population densities, in19 cluding cell-site location information, tri20 angulation data derived from nearby wire21 less or radio frequency networks, and glob22 al positioning system data; 

23 (ii) proximity data, when such term 

24 means information that identifies or esti25 mates the past or present physical proxVerDate Sep 11 2014 04:15 Mar 19, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H651.IH H651

pbinns on DSKJLVW7X2PROD with BILLS
6 

•HR 651 IH

1 imity of one individual or device to an2 other, including information derived from 

3 Bluetooth, audio signatures, nearby wire4 less networks, and near-field communica5 tions; 

6 (iii) demographic data; 

7 (iv) contact information for identifi8 able individuals or a history of the individ9 ual’s contacts over a period of time, such 

10 as an address book or call log; and 

11 (v) any other data collected from a 

12 personal device. 

13 (9) GOVERNMENT ENTITY.—The term ‘‘govern14 ment entity’’ includes a Federal agency, a State, a 

15 local government, and other organizations, as such 

16 terms are defined in section 3371 of title 5, United 

17 States Code. 

18 (10) HEALTH CARE PROVIDER.—The term 

19 ‘‘health care provider’’ has the meaning given the 

20 term ‘‘eligible health care provider’’ in title VIII of 

21 division B the CARES Act (Public Law 116–136). 

22 (11) HIPAA REGULATIONS.—The term 

23 ‘‘HIPAA regulations’’ means parts 160 and 164 of 

24 title 45, Code of Federal Regulations. 


pbinns on DSKJLVW7X2PROD with BILLS
7 

•HR 651 IH

1 (12) PUBLIC HEALTH AUTHORITY.—The term 

2 ‘‘public health authority’’ means an entity that is 

3 authorized by law to collect or receive information 

4 for the purpose of preventing or controlling disease, 

5 injury, or disability including, but not limited to, the 

6 reporting of disease, injury, vital events such as 

7 birth or death, and the conduct of public health sur8 veillance, public health investigations, and public 

9 health interventions, and a person, such as a des10 ignated agency or associate, acting under a grant of 

11 authority from, or under a contract with, such public 

12 entity, including the employees or agents of such en13 tity or its contractors or persons or entities to whom 

14 it has granted authority. 

15 (13) COVID–19 PUBLIC HEALTH EMER16 GENCY.—The term ‘‘COVID–19 public health emer17 gency’’ means the outbreak and public health re18 sponse pertaining to Coronavirus Disease 2019 

19 (COVID–19), associated with the emergency de20 clared by the Secretary on January 31, 2020, under 

21 section 319 of the Public Health Service Act (42 

22 U.S.C. 247d), and any renewals thereof and any 

23 subsequent declarations by the Secretary related to 

24 the coronavirus. 


pbinns on DSKJLVW7X2PROD with BILLS
8 

•HR 651 IH

1 (14) SECRETARY.—The term ‘‘Secretary’’ 

2 means the Secretary of Health and Human Services. 

3 (15) SERVICE PROVIDER.— 

4 (A) IN GENERAL.—The term ‘‘service pro5 vider’’ means a person that collects, uses, or 

6 discloses emergency health data for the sole 

7 purpose of, and only to the extent that such en8 tity is, conducting business activities on behalf 

9 of, for the benefit of, under instruction of, and 

10 under contractual agreement with a covered or11 ganization. 

12 (B) LIMITATION OF APPLICATION.—Such 

13 person shall only be considered a service pro14 vider in the course of activities described in 

15 subparagraph (A). 

16 (C) EXCLUSIONS.—The term ‘‘service pro17 vider’’ excludes a person that develops or oper18 ates a website, web application, mobile applica19 tion, or smart device application for the purpose 

20 of tracking, screening, monitoring, contact trac21 ing, or mitigation, or otherwise responding to 

22 the COVID–19 public health emergency. 

23 (16) STATE.—The term ‘‘State’’ means each 

24 State of the United States, the District of Columbia, 

25 each commonwealth, territory, or possession of the 


pbinns on DSKJLVW7X2PROD with BILLS
9 

•HR 651 IH

1 United States, and each federally recognized Indian 

2 Tribe. 

3 (17) THIRD PARTY.— 

4 (A) IN GENERAL.—The term ‘‘third party’’ 

5 means, with respect to a covered organization— 

6 (i) another person to whom such cov7 ered organization disclosed emergency 

8 health data; and 

9 (ii) a corporate affiliate or a related 

10 party of the covered organization that does 

11 not have a direct relationship with an indi12 vidual with whom the emergency health 

13 data is linked or is reasonably linkable. 

14 (B) EXCLUSION.—The term ‘‘third party’’ 

15 excludes, with respect to a covered organiza16 tion— 

17 (i) a service provider of such covered 

18 organization; or 

19 (ii) a public health authority. 

20 (18) USE.—The term ‘‘use’’, with respect to 

21 emergency health data, means the processing, em22 ployment, application, utilization, examination, or 

23 analysis of such data by a covered organization that 

24 maintains such data. 


pbinns on DSKJLVW7X2PROD with BILLS
10 

•HR 651 IH

1 SEC. 3. PROTECTING THE PRIVACY AND SECURITY OF 

2 EMERGENCY HEALTH DATA. 

3 (a) RIGHT TO PRIVACY.—A covered organization that 

4 collects emergency health data shall— 

5 (1) only collect, use, or disclose such data that 

6 is necessary, proportionate, and limited for a good 

7 faith public health purpose, including a service or 

8 feature to support such a purpose; 

9 (2) take reasonable measures, where possible, to 

10 ensure the accuracy of emergency health data and 

11 provide an effective mechanism for an individual to 

12 correct inaccurate information; 

13 (3) adopt reasonable safeguards to prevent un14 lawful discrimination on the basis of emergency 

15 health data; and 

16 (4) only disclose such data to a government en17 tity when the disclosure— 

18 (A) is to a public health authority; and 

19 (B) is made solely for good faith public 

20 health purposes and in direct response to exi21 gent circumstances. 

22 (b) RIGHT TO SECURITY.—A covered organization or 

23 service provider that collects, uses, or discloses emergency 

24 health data shall establish and implement reasonable data 

25 security policies, practices, and procedures to protect the 

26 security and confidentiality of emergency health data. 


pbinns on DSKJLVW7X2PROD with BILLS
11 

•HR 651 IH

1 (c) PROHIBITED USES.—A covered organization shall 

2 not collect, use, or disclose emergency health data for any 

3 purpose not authorized under this section, including— 

4 (1) commercial advertising, recommendation for 

5 e-commerce, or the training of machine-learning al6 gorithms related to, or subsequently for use in, com7 mercial advertising and e-commerce; 

8 (2) soliciting, offering, selling, leasing, licensing, 

9 renting, advertising, marketing, or otherwise com10 mercially contracting for employment, finance, cred11 it, insurance, housing, or education opportunities in 

12 a manner that discriminates or otherwise makes op13 portunities unavailable on the basis of emergency 

14 health data; and 

15 (3) segregating, discriminating in, or otherwise 

16 making unavailable the goods, services, facilities, 

17 privileges, advantages, or accommodations of any 

18 place of public accommodation (as such term is de19 fined in section 301 of the Americans With Disabil20 ities Act of 1990 (42 U.S.C. 12181)), except as au21 thorized by a State or Federal Government entity 

22 for a public health purpose notwithstanding sub23 section (g). 

24 (d) CONSENT.— 


pbinns on DSKJLVW7X2PROD with BILLS
12 

•HR 651 IH

1 (1) IN GENERAL.—It shall be unlawful for a 

2 covered organization to collect, use, or disclose emer3 gency health data, unless— 

4 (A) the individual to whom the data per5 tains has given affirmative express consent to 

6 such collection, use, or disclosure; 

7 (B) such collection, use, or disclosure is 

8 necessary and for the sole purpose of— 

9 (i) protecting against malicious, de10 ceptive, fraudulent, or illegal activity; or 

11 (ii) detecting, responding to, or pre12 venting information security incidents or 

13 threats; or 

14 (C) the covered organization is compelled 

15 to do so by a legal obligation. 

16 (2) REVOCATION.— 

17 (A) IN GENERAL.—A covered organization 

18 shall provide an effective mechanism for an in19 dividual to revoke consent after it is given. 

20 (B) EFFECT.—After an individual revokes 

21 consent, the covered organization shall cease 

22 collecting, using, or disclosing the individual’s 

23 emergency health data as soon as practicable, 

24 but in no case later than 15 days after the re25 ceipt of the individual’s revocation of consent. 


pbinns on DSKJLVW7X2PROD with BILLS
13 

•HR 651 IH

1 (C) DESTRUCTION.—Not later than 30 

2 days after the receipt of an individual’s revoca3 tion of consent, a covered organization shall de4 stroy or render not linkable that individual’s 

5 emergency health data under the same proce6 dures in subsection (f). 

7 (e) NOTICE.—A covered organization that collects, 

8 uses, or discloses emergency health data shall provide to 

9 an individual a privacy policy that— 

10 (1) is disclosed in a clear and conspicuous man11 ner, in the language in which the individual typically 

12 interacts with the covered organization, prior to or 

13 at the point of the collection of emergency health 

14 data; 

15 (2) describes how and for what purposes the 

16 covered organization collects, uses, and discloses 

17 emergency health data, including the categories of 

18 recipients to whom it discloses data and the purpose 

19 of disclosure for each category; 

20 (3) describes the covered organization’s data re21 tention and data security policies and practices for 

22 emergency health data; and 

23 (4) describes how an individual may exercise 

24 the rights under this Act and how to contact the 

25 Commission to file a complaint. 


pbinns on DSKJLVW7X2PROD with BILLS
14 

•HR 651 IH

1 (f) PUBLIC REPORTING.— 

2 (1) IN GENERAL.—A covered organization that 

3 collects, uses, or discloses emergency health data of 

4 at least 100,000 individuals shall, at least once every 

5 90 days, issue a public report— 

6 (A) stating in aggregate terms the number 

7 of individuals whose emergency health data the 

8 covered organization collected, used, or dis9 closed to the extent practicable; and 

10 (B) describing the categories of emergency 

11 health data collected, used, or disclosed, the 

12 purposes for which each such category of emer13 gency health data was collected, used, or dis14 closed, and the categories of third parties to 

15 whom it was disclosed. 

16 (2) RULES OF CONSTRUCTION.—Nothing in 

17 this subsection shall be construed to require a cov18 ered organization to— 

19 (A) take an action that would convert data 

20 that is not emergency health data into emer21 gency health data; 

22 (B) collect or maintain emergency health 

23 data that the covered organization would other24 wise not maintain; or 


pbinns on DSKJLVW7X2PROD with BILLS
15 

•HR 651 IH

1 (C) maintain emergency health data longer 

2 than the covered organization would otherwise 

3 maintain such data. 

4 (g) REQUIRED DATA DESTRUCTION.— 

5 (1) IN GENERAL.—A covered organization may 

6 not use or maintain emergency health data of an in7 dividual after the later of— 

8 (A) the date that is 60 days after the ter9 mination of the public health emergency de10 clared by the Secretary on January 31, 2020, 

11 pertaining to Coronavirus Disease 2019 

12 (COVID–19) under section 319 of Public 

13 Health Service Act (42 U.S.C. 247d) and any 

14 renewals thereof; 

15 (B) the date that is 60 days after the ter16 mination of a public health emergency declared 

17 by a governor or chief executive of a State per18 taining to Coronavirus Disease 2019 (COVID– 

19 19) in which the individual resides; or 

20 (C) 60 days after collection. 

21 (2) REQUIREMENT.—For the requirements 

22 under paragraph (1), data shall be destroyed or ren23 dered not linkable in such a manner that it is impos24 sible or demonstrably impracticable to identify any 

25 individual from the data. 


pbinns on DSKJLVW7X2PROD with BILLS
16 

•HR 651 IH

1 (3) RELATION TO CERTAIN REQUIREMENTS.— 

2 The provisions of this subsection shall not supersede 

3 any requirements or authorizations under— 

4 (A) the Privacy Act of 1974 (Public Law 

5 93–79); 

6 (B) the HIPAA regulations; or 

7 (C) Federal or State medical records reten8 tion and health privacy laws or regulations, or 

9 other applicable Federal or State laws. 

10 (h) EMERGENCY DATA COLLECTED, USED, OR DIS11 CLOSED BEFORE ENACTMENT.— 

12 (1) INITIATING A RULEMAKING.—Not later 

13 than 7 days after the date of enactment of this Act, 

14 the Commission shall initiate a public rulemaking to 

15 promulgate regulations to ensure a covered organiza16 tion that has collected, used, or disclosed emergency 

17 health data before the date of enactment of this Act 

18 is in compliance with this Act, to the degree prac19 ticable. 

20 (2) COMPLETING A RULEMAKING.—The Com21 mission shall complete the rulemaking within 45 

22 days after the date of enactment of this Act. 

23 (i) NON-APPLICATION TO MANUAL CONTACT TRAC24 ING AND CASE INVESTIGATION.—Nothing in this Act shall 

25 be construed to limit or prohibit a public health authority 


pbinns on DSKJLVW7X2PROD with BILLS
17 

•HR 651 IH

1 from administering programs or activities to identify indi2 viduals who have contracted, or may have been exposed 

3 to, COVID–19 through interviews, outreach, case inves4 tigation, and other recognized investigatory measures by 

5 a public health authority or their designated agent in6 tended to monitor and mitigate the transmission of a dis7 ease or disorder. 

8 (j) RESEARCH AND DEVELOPMENT.—This section 

9 shall not be construed to prohibit— 

10 (1) public health or scientific research associ11 ated with the COVID–19 public health emergency 

12 by— 

13 (A) a public health authority; 

14 (B) a nonprofit organization, as described 

15 in section 501(c)(3) of the Internal Revenue 

16 Code of 1986; or 

17 (C) an institution of higher education, as 

18 such term is defined in section 101 of the High19 er Education Act of 1965 (20 U.S.C. 1001); or 

20 (2) research, development, manufacture, or dis21 tribution of a drug, biological product, or vaccine 

22 that relates to a disease or disorder that is associ23 ated or potentially associated with a public health 

24 emergency. 


pbinns on DSKJLVW7X2PROD with BILLS
18 

•HR 651 IH

1 (k) LEGAL REQUIREMENTS.—Notwithstanding sub2 section (a)(5), nothing in this Act shall be construed to 

3 prohibit a good faith response to, or compliance with, oth4 erwise valid subpoenas, court orders, or other legal proc5 esses, or to prohibit storage or providing information as 

6 otherwise required by law. 

7 (l) APPLICATION TO HIPAA COVERED ENTITIES.— 

8 (1) IN GENERAL.—This Act does not apply to 

9 a ‘‘covered entity’’ or a person acting as a ‘‘business 

10 associate’’ under the HIPAA regulations (to the ex11 tent that such entities or associates are acting in 

12 such capacity) or any health care provider. 

13 (2) GUIDANCE FOR CONSISTENCY.—Not later 

14 than 30 days after the date of enactment of this 

15 Act, the Secretary shall promulgate guidance on the 

16 applicability of requirements, similar to those in this 

17 section to ‘‘covered entities’’ and persons acting as 

18 ‘‘business associates’’ under the HIPAA regulations. 

19 In promulgating such guidance, the Secretary shall 

20 reduce duplication of requirements and may exclude 

21 a requirement of this section if such requirement is 

22 already a requirement of the HIPAA regulations. 

23 SEC. 4. PROTECTING THE RIGHT TO VOTE. 

24 (a) IN GENERAL.—A government entity may not, and 

25 a covered organization may not knowingly facilitate, on 


pbinns on DSKJLVW7X2PROD with BILLS
19 

•HR 651 IH

1 the basis of an individual’s emergency health data, medical 

2 condition, or participation or non-participation in a pro3 gram to collect emergency health data— 

4 (1) deny, restrict, or interfere with the right to 

5 vote in a Federal, State, or local election; 

6 (2) attempt to deny, restrict, or interfere with 

7 the right to vote in a Federal, State, or local elec8 tion; or 

9 (3) retaliate against an individual for voting in 

10 a Federal, State, or local election. 

11 (b) CIVIL ACTION.—In the case of any violation of 

12 subsection (a), an individual may bring a civil action to 

13 obtain appropriate relief against a government entity in 

14 a Federal district court. 

15 SEC. 5. REPORTS ON CIVIL RIGHTS IMPACTS. 

16 (a) REPORT REQUIRED.—The Secretary, in consulta17 tion with the United States Commission on Civil Rights 

18 and the Commission, shall prepare and submit to Con19 gress reports that examines the civil rights impact of the 

20 collection, use, and disclosure of health information in re21 sponse to the COVID–19 public health emergency. 

22 (b) SCOPE OF REPORT.—Each report required under 

23 subsection (a) shall, at a minimum— 

24 (1) evaluate the impact of such practices on 

25 civil rights and protections for individuals based on 


pbinns on DSKJLVW7X2PROD with BILLS
20 

•HR 651 IH

1 race, color, ethnicity, national origin, religion, sex, 

2 gender, gender identity, sexual orientation, age, 

3 Tribal affiliation, disability, domicile, employment 

4 status, familial status, immigration status, or vet5 eran status; 

6 (2) analyze the impact, risks, costs, legal con7 siderations, disparate impacts, and other implica8 tions to civil rights of policies to incentivize or re9 quire the adoption of digital tools or apps used for 

10 contact tracing, exposure notification, or health 

11 monitoring; and 

12 (3) include recommendations on preventing and 

13 addressing undue or disparate impact, segregation, 

14 discrimination, or infringements of civil rights in the 

15 collection and use of health information, including 

16 during a national health emergency. 

17 (c) TIMING.— 

18 (1) INITIAL REPORT.—The Secretary shall sub19 mit an initial report under subsection (a) not sooner 

20 than 9 months, and not later than 12 months after 

21 the date of enactment of this Act. 

22 (2) SUBSEQUENT REPORTS.—The Secretary 

23 shall submit reports annually after the initial report 

24 required under paragraph (1) until 1 year after the 

25 termination of any public health emergency perVerDate Sep 11 2014 04:15 Mar 19, 2021 Jkt 019200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6201 E:\BILLS\H651.IH H651

pbinns on DSKJLVW7X2PROD with BILLS
21 

•HR 651 IH

1 taining to Coronavirus Disease 2019 (COVID–19) 

2 under section 319 of Public Health Service Act (42 

3 U.S.C. 247d). 

4 SEC. 6. ENFORCEMENT. 

5 (a) FEDERAL TRADE COMMISSION.— 

6 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC7 TICES.—A violation of this Act or a regulation pro8 mulgated under this Act shall be treated as a viola9 tion of a rule defining an unfair or deceptive act or 

10 practice under section 18(a)(1)(B) of the Federal 

11 Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) re12 garding unfair or deceptive acts or practices. 

13 (2) POWERS OF COMMISSION.—The Commis14 sion shall enforce this Act and the regulations pro15 mulgated under this Act in the same manner, by the 

16 same means, and with the same jurisdiction, powers, 

17 and duties as though all applicable terms and provi18 sions of the Federal Trade Commission Act (15 

19 U.S.C. 41 et seq.) were incorporated into and made 

20 a part of this Act. Any person who violates this Act 

21 or a regulation promulgated under this Act shall be 

22 subject to the penalties and entitled to the privileges 

23 and immunities provided in the Federal Trade Com24 mission Act. Provided, however, that, notwith25 standing the requirements of section 16(a) of the 


pbinns on DSKJLVW7X2PROD with BILLS
22 

•HR 651 IH

1 Federal Trade Commission Act (15 U.S.C. 56(a)), 

2 the Commission shall have the exclusive authority to 

3 commence or defend, and supervise the litigation of, 

4 any action for a violation of this Act or a regulation 

5 promulgated under this Act and any appeal of such 

6 action in its own name by any of its attorneys des7 ignated by it for such purpose, without first refer8 ring the matter to the Attorney General. 

9 (3) RULEMAKING AUTHORITY.— 

10 (A) IN GENERAL.—The Commission shall 

11 have authority under section 553 of title 5, 

12 United States Code, to promulgate any regula13 tions necessary to implement this Act. 

14 (B) CONSULTATION.—In promulgating any 

15 regulations under this Act, the Commission 

16 shall consult with the Secretary. 

17 (4) COMMON CARRIERS AND NONPROFIT ORGA18 NIZATIONS.—Notwithstanding section 4, 5(a)(2), or 

19 6 of the Federal Trade Commission Act (15 U.S.C. 

20 44; 45(a)(2); 46) or any jurisdictional limitation of 

21 the Commission, the Commission shall also enforce 

22 this Act, in the same manner provided in paragraphs 

23 (1) and (2) of this paragraph, with respect to— 

24 (A) common carriers subject to the Acts to 

25 regulate commerce, air carriers, and foreign air 


pbinns on DSKJLVW7X2PROD with BILLS
23 

•HR 651 IH

1 carriers subject to part A of subtitle VII of title 

2 49, and persons, partnerships, or corporations 

3 insofar as they are subject to the Packers and 

4 Stockyards Act, 1921 (7 U.S.C. 181 et seq.), 

5 except as provided in section 406(b) of such Act 

6 (7 U.S.C. 227(b)); and 

7 (B) organizations not organized to carry 

8 on business for their own profit or that of their 

9 members. 

10 (b) ENFORCEMENT BY STATES.— 

11 (1) IN GENERAL.—In any case in which the at12 torney general of a State has reason to believe that 

13 an interest of the residents of the State has been or 

14 is threatened or adversely affected by the engage15 ment of any person subject to this Act in a practice 

16 that violates such subsection, the attorney general of 

17 the State may, as parens patriae, bring a civil action 

18 on behalf of the residents of the State in an appro19 priate district court of the United States to obtain 

20 appropriate relief. 

21 (2) RIGHTS OF THE FEDERAL TRADE COMMIS22 SION.— 

23 (A) NOTICE TO FEDERAL TRADE COMMIS24 SION.— 


pbinns on DSKJLVW7X2PROD with BILLS
24 

•HR 651 IH

1 (i) IN GENERAL.—Except as provided 

2 in clause (iii), the attorney general of a 

3 State shall notify the Commission in writ4 ing that the attorney general intends to 

5 bring a civil action under paragraph (1) 

6 before initiating the civil action against a 

7 person subject to this Act. 

8 (ii) CONTENTS.—The notification re9 quired by clause (i) with respect to a civil 

10 action shall include a copy of the complaint 

11 to be filed to initiate the civil action. 

12 (iii) EXCEPTION.—If it is not feasible 

13 for the attorney general of a State to pro14 vide the notification required by clause (i) 

15 before initiating a civil action under para16 graph (1), the attorney general shall notify 

17 the Commission immediately upon insti18 tuting the civil action. 

19 (B) INTERVENTION BY THE FEDERAL

20 TRADE COMMISSION.—The Commission may— 

21 (i) intervene in any civil action 

22 brought by the attorney general of a State 

23 under paragraph (1); and 

24 (ii) upon intervening— 


pbinns on DSKJLVW7X2PROD with BILLS
25 

•HR 651 IH

1 (I) be heard on all matters aris2 ing in the civil action; and 

3 (II) file petitions for appeal of a 

4 decision in the civil action. 

5 (C) INVESTIGATORY POWERS.—Nothing in 

6 this subsection may be construed to prevent the 

7 attorney general of a State from exercising the 

8 powers conferred on the attorney general by the 

9 laws of the State to conduct investigations, to 

10 administer oaths or affirmations, or to compel 

11 the attendance of witnesses or the production of 

12 documentary or other evidence. 

13 (3) ACTION BY THE FEDERAL TRADE COMMIS14 SION.—If the Commission institutes a civil action 

15 with respect to a violation of this Act, the attorney 

16 general of a State may not, during the pendency of 

17 such action, bring a civil action under paragraph (1) 

18 of this subsection against any defendant named in 

19 the complaint of the Commission for the violation 

20 with respect to which the Commission instituted 

21 such action. 

22 (4) VENUE; SERVICE OF PROCESS.— 

23 (A) VENUE.—Any action brought under 

24 paragraph (1) may be brought in— 


pbinns on DSKJLVW7X2PROD with BILLS
26 

•HR 651 IH

1 (i) the district court of the United 

2 States that meets applicable requirements 

3 relating to venue under section 1391 of 

4 title 28, United States Code; or 

5 (ii) another court of competent juris6 diction. 

7 (B) SERVICE OF PROCESS.—In an action 

8 brought under paragraph (1), process may be 

9 served in any district in which the defendant— 

10 (i) is an inhabitant; or 

11 (ii) may be found. 

12 (C) ACTIONS BY OTHER STATE OFFI13 CIALS.— 

14 (i) IN GENERAL.—In addition to civil 

15 actions brought by attorneys general under 

16 paragraph (1), any other officer of a State 

17 who is authorized by the State to do so 

18 may bring a civil action under paragraph 

19 (1), subject to the same requirements and 

20 limitations that apply under this sub21 section to civil actions brought by attor22 neys general. 

23 (ii) SAVINGS PROVISION.—Nothing in 

24 this subsection may be construed to pro25 hibit an authorized official of a State from 


pbinns on DSKJLVW7X2PROD with BILLS
27 

•HR 651 IH

1 initiating or continuing any proceeding in 

2 a court of the State for a violation of any 

3 civil or criminal law of the State. 

4 (c) PRIVATE RIGHT OF ACTION.— 

5 (1) ENFORCEMENT BY INDIVIDUALS.— 

6 (A) IN GENERAL.—Any individual alleging 

7 a violation of this Act may bring a civil action 

8 in any court of competent jurisdiction, State or 

9 Federal. 

10 (B) RELIEF.—In a civil action brought 

11 under paragraph (1) in which the plaintiff pre12 vails, the court may award— 

13 (i) an amount not less than $100 and 

14 not greater than $1,000 per violation 

15 against any person who negligently violates 

16 a provision of this Act; 

17 (ii) an amount not less than $500 and 

18 not greater than $5,000 per violation 

19 against any person who recklessly, will20 fully, or intentionally violates a provision of 

21 this Act; 

22 (iii) reasonable attorney’s fees and 

23 litigation costs; and 


pbinns on DSKJLVW7X2PROD with BILLS
28 

•HR 651 IH

1 (iv) any other relief, including equi2 table or declaratory relief, that the court 

3 determines appropriate. 

4 (C) INJURY IN FACT.—A violation of this 

5 Act with respect to the emergency health data 

6 of an individual constitutes a concrete and par7 ticularized injury in fact to that individual. 

8 (2) INVALIDITY OF PRE-DISPUTE ARBITRATION

9 AGREEMENTS AND PRE-DISPUTE JOINT ACTION

10 WAIVERS.— 

11 (A) IN GENERAL.—Notwithstanding any 

12 other provision of law, no pre-dispute arbitra13 tion agreement or pre-dispute joint action waiv14 er shall be valid or enforceable with respect to 

15 a dispute arising under this Act. 

16 (B) APPLICABILITY.—Any determination 

17 as to whether or how this subsection applies to 

18 any dispute shall be made by a court, rather 

19 than an arbitrator, without regard to whether 

20 such agreement purports to delegate such deter21 mination to an arbitrator. 

22 (C) DEFINITIONS.—In this subsection: 

23 (i) The term ‘‘pre-dispute arbitration 

24 agreement’’ means any agreement to arbiVerDate Sep 11 2014 04:15 Mar 19, 2021 Jkt 019200 PO 00000 Frm 00028 Fmt 6652 Sfmt 6201 E:\BILLS\H651.IH H651

pbinns on DSKJLVW7X2PROD with BILLS
29 

•HR 651 IH

1 trate a dispute that has not arisen at the 

2 time of making the agreement. 

3 (ii) The term ‘‘pre-dispute joint-action 

4 waiver’’ means an agreement, whether or 

5 not part of a pre-dispute arbitration agree6 ment, that would prohibit, or waive the 

7 right of, one of the parties to the agree8 ment to participate in a joint, class, or col9 lective action in a judicial, arbitral, admin10 istration, or other forum, concerning a dis11 pute that has not yet arisen at the time of 

12 making the agreement. 

13 (iii) The term ‘‘dispute’’ means any 

14 claim related to an alleged violation of this 

15 Act and between an individual and a cov16 ered organization. 

17 SEC. 7. NONPREEMPTION. 

18 Nothing in this Act shall preempt or supersede, or 

19 be interpreted to preempt or supersede, any Federal or 

20 State law or regulation, or limit the authority of the Com21 mission or the Secretary under any other provision of law. 

22 SEC. 8. EFFECTIVE DATE. 

23 (a) IN GENERAL.—This Act shall apply beginning on 

24 the date that is 30 days after the date of enactment of 

25 this Act. 


pbinns on DSKJLVW7X2PROD with BILLS
30 

•HR 651 IH

1 (b) AUTHORITY TO PROMULGATE REGULATIONS AND

2 TAKE CERTAIN OTHER ACTIONS.—Nothing in subsection 

3 (a) affects— 

4 (1) the authority of any person to take an ac5 tion expressly required by a provision of this Act be6 fore the effective date described in such subsection; 

7 or 

8 (2) the authority of the Commission to promul9 gate regulations to implement this Act or begin a 

10 rulemaking to promulgate such regulations. 

Æ 


pbinns on DSKJLVW7X2PROD with BILLS