Public Health Emergency Privacy Act

To protect the privacy of health information during a national health emergency. 1. Short title This Act may be cited as the Public Health Emergency Privacy Act 2. Definitions In this Act: (1) Affirmative express consent The term affirmative express consent (A) clearly and conspicuously communicates the individual’s authorization of an act or practice; (B) is made in the absence of any mechanism in the user interface that has the purpose or substantial effect of obscuring, subverting, or impairing decision making or choice to obtain consent; and (C) cannot be inferred from inaction. (2) Collect The term collect (3) Commission The term Commission (4) Covered organization (A) In general The term covered organization (i) that collects, uses, or discloses emergency health data electronically or through communication by wire or radio; or (ii) that develops or operates a website, web application, mobile application, mobile operating system feature, or smart device application for the purpose of tracking, screening, monitoring, contact tracing, or mitigation, or otherwise responding to the COVID–19 public health emergency. (B) Exclusions The term covered organization (i) a health care provider; (ii) a person engaged in a de minimis collection or processing of emergency health data; (iii) a service provider; (iv) a person acting in their individual or household capacity; or (v) a public health authority. (5) Demographic data The term demographic data (6) Device The term device (7) Disclosure The term disclosure (8) Emergency health data The term emergency health data (A) information that reveals the past, present, or future physical or behavioral health or condition of, or provision of healthcare to, an individual, including— (i) data derived from the testing or examination of a body part or bodily substance, or a request for such testing; (ii) whether or not an individual has contracted or been tested for, or an estimate of the likelihood that a particular individual may contract, such disease or disorder; and (iii) genetic data, biological samples, and biometrics; and (B) other data collected in conjunction with other emergency health data or for the purpose of tracking, screening, monitoring, contact tracing, or mitigation, or otherwise responding to the COVID–19 public health emergency, including— (i) geolocation data, when such term means data capable of determining the past or present precise physical location of an individual at a specific point in time, taking account of population densities, including cell-site location information, triangulation data derived from nearby wireless or radio frequency networks, and global positioning system data; (ii) proximity data, when such term means information that identifies or estimates the past or present physical proximity of one individual or device to another, including information derived from Bluetooth, audio signatures, nearby wireless networks, and near-field communications; (iii) demographic data; (iv) contact information for identifiable individuals or a history of the individual’s contacts over a period of time, such as an address book or call log; and (v) any other data collected from a personal device. (9) Government entity The term government entity (10) Health care provider The term health care provider eligible health care provider Public Law 116–136 (11) HIPAA regulations The term HIPAA regulations (12) Public health authority The term public health authority (13) COVID–19 Public health emergency The term COVID–19 public health emergency 42 U.S.C. 247d (14) Secretary The term Secretary (15) Service provider (A) In general The term service provider (B) Limitation of application Such person shall only be considered a service provider in the course of activities described in subparagraph (A). (C) Exclusions The term service provider (16) State The term State (17) Third party (A) In general The term third party (i) another person to whom such covered organization disclosed emergency health data; and (ii) a corporate affiliate or a related party of the covered organization that does not have a direct relationship with an individual with whom the emergency health data is linked or is reasonably linkable. (B) Exclusion The term third party (i) a service provider of such covered organization; or (ii) a public health authority. (18) Use The term use 3. Protecting the privacy and security of emergency health data (a) Right to privacy A covered organization that collects emergency health data shall— (1) only collect, use, or disclose such data that is necessary, proportionate, and limited for a good faith public health purpose, including a service or feature to support such a purpose; (2) take reasonable measures, where possible, to ensure the accuracy of emergency health data and provide an effective mechanism for an individual to correct inaccurate information; (3) adopt reasonable safeguards to prevent unlawful discrimination on the basis of emergency health data; and (4) only disclose such data to a government entity when the disclosure— (A) is to a public health authority; and (B) is made in solely for good faith public health purposes and in direct response to exigent circumstances. (b) Right to security A covered organization or service provider that collects, uses, or discloses emergency health data shall establish and implement reasonable data security policies, practices, and procedures to protect the security and confidentiality of emergency health data. (c) Prohibited uses A covered organization shall not collect, use, or disclose emergency health data for any purpose not authorized under this section, including— (1) commercial advertising, recommendation for e-commerce, or the training of machine-learning algorithms related to, or subsequently for use in, commercial advertising and e-commerce; (2) soliciting, offering, selling, leasing, licensing, renting, advertising, marketing, or otherwise commercially contracting for employment, finance, credit, insurance, housing, or education opportunities in a manner that discriminates or otherwise makes opportunities unavailable on the basis of emergency health data; and (3) segregating, discriminating in, or otherwise making unavailable the goods, services, facilities, privileges, advantages, or accommodations of any place of public accommodation (as such term is defined in section 301 of the Americans With Disabilities Act of 1990 ( 42 U.S.C. 12181 (d) Consent (1) In general It shall be unlawful for a covered organization to collect, use, or disclose emergency health data, unless— (A) the individual to whom the data pertains has given affirmative express consent to such collection, use, or disclosure; (B) such collection, use, or disclosure is necessary and for the sole purpose of— (i) protecting against malicious, deceptive, fraudulent, or illegal activity; or (ii) detecting, responding to, or preventing information security incidents or threats; or (C) the covered organization is compelled to do so by a legal obligation. (2) Revocation (A) In general A covered organization shall provide an effective mechanism for an individual to revoke consent after it is given. (B) Effect After an individual revokes consent, the covered organization shall cease collecting, using, or disclosing the individual’s emergency health data as soon as practicable, but in no case later than 15 days after the receipt of the individual’s revocation of consent. (C) Destruction Not later than 30 days after the receipt of an individual’s revocation of consent, a covered organization shall destroy or render not linkable that individuals emergency health data under the same procedures in subsection (f). (e) Notice A covered organization that collects, uses, or discloses emergency health data shall provide to an individual a privacy policy that— (1) is disclosed in a clear and conspicuous manner, in the language in which the individual typically interacts with the covered organization, prior to or at the point of the collection of emergency health data; (2) describes how and for what purposes the covered organization collects, uses, and discloses emergency health data, including the categories of recipients to whom it discloses data and the purpose of disclosure for each category; (3) describes the covered organization’s data retention and data security policies and practices for emergency health data; and (4) describes how an individual may exercise the rights under this Act and how to contact the Commission to file a complaint. (f) Public reporting (1) In general A covered organization that collects, uses, or discloses emergency health data of at least 100,000 individuals shall, at least once every 90 days, issue a public report— (A) stating in aggregate terms the number of individuals whose emergency health data the covered organization collected, used, or disclosed to the extent practicable; and (B) describing the categories of emergency health data collected, used, or disclosed, the purposes for which each such category of emergency health data was collected, used, or disclosed, and the categories of third parties to whom it was disclosed. (2) Rules of construction Nothing in this subsection shall be construed to require a covered organization to— (A) take an action that would convert data that is not emergency health data into emergency health data; (B) collect or maintain emergency health data that the covered organization would otherwise not maintain; or (C) maintain emergency health data longer than the covered organization would otherwise maintain such data. (g) Required data destruction (1) In general A covered organization may not use or maintain emergency health data of an individual after the later of— (A) the date that is 60 days after the termination of the public health emergency declared by the Secretary on January 31, 2020, pertaining to Coronavirus Disease 2019 (COVID–19) under section 319 of the Public Health Service Act ( 42 U.S.C. 247d (B) the date that is 60 days after the termination of a public health emergency declared by a governor or chief executive of a State pertaining to Coronavirus Disease 2019 (COVID–19) in which the individual resides; or (C) 60 days after collection. (2) Requirement For the requirements under paragraph (1), data shall be destroyed or rendered not linkable in such a manner that it is impossible or demonstrably impracticable to identify any individual from the data. (3) Relation to certain requirements The provisions of this subsection shall not supersede any requirements or authorizations under— (A) the Privacy Act of 1974 ( Public Law 93–79 (B) the HIPPA regulations; or (C) Federal or State medical records retention and health privacy laws or regulations, or other applicable Federal or State laws. (h) Emergency data collected, used, or disclosed before enactment (1) Initiating a rulemaking Not later than 7 days after the date of enactment of this Act, the Commission shall initiate a public rulemaking to promulgate regulations to ensure a covered organization that has collected, used, or disclosed emergency health data before the date of enactment of this Act is in compliance with this Act, to the degree practicable. (2) Completing a rulemaking The Commission shall complete the rulemaking within 45 days after the date of enactment of this Act. (i) Non-Application to manual contact tracing and case investigation Nothing in this Act shall be construed to limit or prohibit a public health authority from administering programs or activities to identify individuals who have contracted, or may have been exposed to, COVID–19 through interviews, outreach, case investigation, and other recognized investigatory measures by a public health authority or their designated agent by a public health authority or their designated agent intended to monitor and mitigate the transmission of a disease or disorder. (j) Research and development This section shall not be construed to prohibit— (1) public health or scientific research associated with the COVID–19 public health emergency by— (A) a public health authority; (B) a nonprofit organization, as described in section 501(c)(3) (C) an institution of higher education, as such term is defined in section 101 of the Higher Education Act of 1965 ( 20 U.S.C. 1001 (2) research, development, manufacture, or distribution of a drug, biological product, or vaccine that relates to a disease or disorder that is associated or potentially associated with a public health emergency. (k) Legal requirements Notwithstanding subsection (a)(5), nothing in this Act shall be construed to prohibit a good faith response to, or compliance with, otherwise valid subpoenas, court orders, or other legal processes, or to prohibit storage or providing information as otherwise required by law. (l) Application to HIPAA covered entities (1) In general This Act does not apply to a covered entity business associate (2) Guidance for consistency Not later than 30 days after the date of enactment of this Act, the Secretary shall promulgate guidance on the applicability of requirements, similar to those in this section to covered entities business associates 4. Protecting the right to vote (a) In general A government entity may not, and a covered organization may not knowingly facilitate, on the basis of an individual’s emergency health data, medical condition, or participation or non-participation in a program to collect emergency health data— (1) deny, restrict, or interfere with the right to vote in a Federal, State, or local election; (2) attempt to deny, restrict, or interfere with the right to vote in a Federal, State, or local election; or (3) retaliate against an individual for voting in a Federal, State, or local election. (b) Civil action In the case of any violation of subsection (a), an individual may bring a civil action to obtain appropriate relief against a government entity in a Federal district court. 5. Reports on civil rights impacts (a) Report required The Secretary, in consultation with the United States Commission on Civil Rights and the Commission, shall prepare and submit to Congress reports that examines the civil rights impact of the collection, use, and disclosure of health information in response to the COVID–19 public health emergency. (b) Scope of report Each report required under subsection (a) shall, at a minimum— (1) evaluate the impact of such practices on civil rights and protections for individuals based on race, color, ethnicity, national origin, religion, sex, gender, gender identity, sexual orientation, age, Tribal affiliation, disability, domicile, employment status, familial status, immigration status, or veteran status; (2) analyze the impact, risks, costs, legal considerations, disparate impacts, and other implications to civil rights of policies to incentivize or require the adoption of digital tools or apps used for contact tracing, exposure notification, or health monitoring; and (3) include recommendations on preventing and addressing undue or disparate impact, segregation, discrimination, or infringements of civil rights in the collection and use of health information, including during a national health emergency. (c) Timing (1) Initial report The Secretary shall submit an initial report under subsection (a) not sooner than 9 months, and not later than 12 months after the date of enactment of this Act. (2) Subsequent reports The Secretary shall submit reports annually after the initial report required under paragraph (1) until 1 year after the termination of any public health emergency pertaining to Coronavirus Disease 2019 (COVID–19) under section 319 of the Public Health Service Act ( 42 U.S.C. 247d 6. Enforcement (a) Federal Trade Commission (1) Unfair or deceptive acts or practices A violation of this Act or a regulation promulgated under this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) (2) Powers of Commission The Commission shall enforce this Act and the regulations promulgated under this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 15 U.S.C. 56(a) (3) Rulemaking authority (A) In general The Commission shall have authority under section 553 of title 5, United States Code, to promulgate any regulations necessary to implement this Act. (B) Consultation In promulgating any regulations under this Act, the Commission shall consult with the Secretary. (4) Common carriers and nonprofit organizations Notwithstanding section 4, 5(a)(2), or 6 of the Federal Trade Commission Act ( 15 U.S.C. 44 (A) common carriers subject to the Acts to regulate commerce, air carriers, and foreign air carriers subject to part A of subtitle VII of title 49, and persons, partnerships, or corporations insofar as they are subject to the Packers and Stockyards Act, 1921 ( 7 U.S.C. 181 7 U.S.C. 227(b) (B) organizations not organized to carry on business for their own profit or that of their members. (b) Enforcement by States (1) In general In any case in which the attorney general of a State has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of any person subject to this Act in a practice that violates such subsection, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate district court of the United States to obtain appropriate relief. (2) Rights of the Federal Trade Commission (A) Notice to Federal Trade Commission (i) In general Except as provided in clause (iii), the attorney general of a State shall notify the Commission in writing that the attorney general intends to bring a civil action under paragraph (1) before initiating the civil action against a person subject to this Act. (ii) Contents The notification required by clause (i) with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action. (iii) Exception If it is not feasible for the attorney general of a State to provide the notification required by clause (i) before initiating a civil action under paragraph (1), the attorney general shall notify the Commission immediately upon instituting the civil action. (B) Intervention by the Federal Trade Commission The Commission may— (i) intervene in any civil action brought by the attorney general of a State under paragraph (1); and (ii) upon intervening— (I) be heard on all matters arising in the civil action; and (II) file petitions for appeal of a decision in the civil action. (C) Investigatory powers Nothing in this subsection may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence. (3) Action by the Federal Trade Commission If the Commission institutes a civil action with respect to a violation of this Act, the attorney general of a State may not, during the pendency of such action, bring a civil action under paragraph (1) of this subsection against any defendant named in the complaint of the Commission for the violation with respect to which the Commission instituted such action. (4) Venue; service of process (A) Venue Any action brought under paragraph (1) may be brought in— (i) the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or (ii) another court of competent jurisdiction. (B) Service of process In an action brought under paragraph (1), process may be served in any district in which the defendant— (i) is an inhabitant; or (ii) may be found. (C) Actions by other State officials (i) In general In addition to civil actions brought by attorneys general under paragraph (1), any other officer of a State who is authorized by the State to do so may bring a civil action under paragraph (1), subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general. (ii) Savings provision Nothing in this subsection may be construed to prohibit an authorized official of a State from initiating or continuing any proceeding in a court of the State for a violation of any civil or criminal law of the State. (c) Private right of action (1) Enforcement by individuals (A) In general Any individual alleging a violation of this Act may bring a civil action in any court of competent jurisdiction, State or Federal. (B) Relief In a civil action brought under paragraph (1) in which the plaintiff prevails, the court may award— (i) an amount not less than $100 and not greater than $1,000 per violation against any person who negligently violates a provision of this Act; (ii) an amount not less than $500 and not greater than $5,000 per violation against any person who recklessly, willfully, or intentionally violates a provision of this Act; (iii) reasonable attorney’s fees and litigation costs; and (iv) any other relief, including equitable or declaratory relief, that the court determines appropriate. (C) Injury in fact A violation of this Act with respect to the emergency health data of an individual constitutes a concrete and particularized injury in fact to that individual. (2) Invalidity of pre-dispute arbitration agreements and pre-dispute joint action waivers (A) In general Notwithstanding any other provision of law, no pre-dispute arbitration agreement or pre-dispute joint action waiver shall be valid or enforceable with respect to a dispute arising under this Act. (B) Applicability Any determination as to whether or how this subsection applies to any dispute shall be made by a court, rather than an arbitrator, without regard to whether such agreement purports to delegate such determination to an arbitrator. (C) Definitions In this subsection: (i) The term pre-dispute arbitration agreement (ii) The term pre-dispute joint-action waiver (iii) The term dispute 7. Nonpreemption Nothing in this Act shall preempt or supersede, or be interpreted to preempt or supersede, any Federal or State law or regulation, or limit the authority of the Commission or the Secretary under any other provision of law. 8. Effective date (a) In general This Act shall apply beginning on the date that is 30 days after the date of enactment of this Act. (b) Authority To promulgate regulations and take certain other actions Nothing in subsection (a) affects— (1) the authority of any person to take an action expressly required by a provision of this Act before the effective date described in such subsection; or (2) the authority of the Commission to promulgate regulations to implement this Act or begin a rulemaking to promulgate such regulations.

Summary: Public Health Emergency Privacy Act This bill imposes requirements on covered organizations concerning the privacy, confidentiality, and security of COVID-19 (i.e., coronavirus disease 2019) emergency health data, which is data that is linked to an individual or device, such as test results. Covered organizations include those that collect, use, or disclose such data electronically or that develop or operate websites or applications for contact tracing and other COVID-19 response activities. Among other actions, covered organizations must provide notice of privacy and other policies, as well as ensure the accuracy of, prevent discrimination based on, and limit disclosure of the data. Covered organizations that collect data from at least 100,000 individuals must publicly report additional information about how they use and disclose the data. The bill also prohibits the use of emergency health data for commercial advertising or in ways that restrict access to opportunities, services, and other accommodations. In addition, government entities and covered organizations shall not use emergency health data to infringe on the right to vote. The Department of Health and Human Services must report on the civil rights impact of the collection, use, and disclosure of health data. The bill provides for enforcement by the Federal Trade Commission, states, and a private right of action and specifies that pre-dispute resolution mechanisms, such as arbitration, are unenforceable with respect to disputes arising under the bill.