United States, and each federally recognized Indian 
Tribe. 
(17) THIRD PARTY.— 
(A) IN GENERAL.—The term ‘‘third party’’ 
means, with respect to a covered organization— 
(i) another person to whom such cov-
ered 
organization 
disclosed 
emergency 
health data; and 
(ii) a corporate affiliate or a related 
party of the covered organization that does 
not have a direct relationship with an indi-
vidual with whom the emergency health 
data is linked or is reasonably linkable. 
(B) EXCLUSION.—The term ‘‘third party’’ 
excludes, with respect to a covered organiza-
tion— 
(i) a service provider of such covered 
organization; or 
(ii) a public health authority. 
(18) USE.—The term ‘‘use’’, with respect to 
emergency health data, means the processing, em-
ployment, application, utilization, examination, or 
analysis of such data by a covered organization that 
maintains such data. 
VerDate Sep 11 2014 
01:43 Jun 28, 2020
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H6866.IH
H6866
kjohnson on DSK79L0C42PROD with BILLS
SEC. 3. PROTECTING THE PRIVACY AND SECURITY OF 
EMERGENCY HEALTH DATA. 
(a) RIGHT TO PRIVACY.—A covered organization that 
collects emergency health data shall— 
(1) only collect, use, or disclose such data that 
is necessary, proportionate, and limited for a good 
faith public health purpose, including a service or 
feature to support such a purpose; 
(2) take reasonable measures, where possible, to 
ensure the accuracy of emergency health data and 
provide an effective mechanism for an individual to 
correct inaccurate information; 
(3) adopt reasonable safeguards to prevent un-
lawful discrimination on the basis of emergency 
health data; and 
(4) only disclose such data to a government en-
tity when the disclosure— 
(A) is to a public health authority; and 
(B) is made in solely for good faith public 
health purposes and in direct response to exi-
gent circumstances. 
(b) RIGHT TO SECURITY.—A covered organization or 
service provider that collects, uses, or discloses emergency 
health data shall establish and implement reasonable data 
security policies, practices, and procedures to protect the 
security and confidentiality of emergency health data. 
VerDate Sep 11 2014 
01:43 Jun 28, 2020
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H6866.IH
H6866
kjohnson on DSK79L0C42PROD with BILLS
(c) PROHIBITED USES.—A covered organization shall 
not collect, use, or disclose emergency health data for any 
purpose not authorized under this section, including— 
(1) commercial advertising, recommendation for 
e-commerce, or the training of machine-learning al-
gorithms related to, or subsequently for use in, com-
mercial advertising and e-commerce; 
(2) soliciting, offering, selling, leasing, licensing, 
renting, advertising, marketing, or otherwise com-
mercially contracting for employment, finance, cred-
it, insurance, housing, or education opportunities in 
a manner that discriminates or otherwise makes op-
portunities unavailable on the basis of emergency 
health data; and 
(3) segregating, discriminating in, or otherwise 
making unavailable the goods, services, facilities, 
privileges, advantages, or accommodations of any 
place of public accommodation (as such term is de-
fined in section 301 of the Americans With Disabil-
ities Act of 1990 (42 U.S.C. 12181)), except as au-
thorized by a State or Federal Government entity 
for a public health purpose notwithstanding sub-
section (g). 
(d) CONSENT.— 
VerDate Sep 11 2014 
01:43 Jun 28, 2020
Jkt 099200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H6866.IH
H6866
kjohnson on DSK79L0C42PROD with BILLS
(1) IN GENERAL.—It shall be unlawful for a 
covered organization to collect, use, or disclose emer-
gency health data, unless— 
(A) the individual to whom the data per-
tains has given affirmative express consent to 
such collection, use, or disclosure; 
(B) such collection, use, or disclosure is 
necessary and for the sole purpose of— 
(i) protecting against malicious, de-
ceptive, fraudulent, or illegal activity; or 
(ii) detecting, responding to, or pre-
venting information security incidents or 
threats; or 
(C) the covered organization is compelled 
to do so by a legal obligation. 
(2) REVOCATION.— 
(A) IN GENERAL.—A covered organization 
shall provide an effective mechanism for an in-
dividual to revoke consent after it is given. 
(B) EFFECT.—After an individual revokes 
consent, the covered organization shall cease 
collecting, using, or disclosing the individual’s 
emergency health data as soon as practicable, 
but in no case later than 15 days after the re-
ceipt of the individual’s revocation of consent. 
VerDate Sep 11 2014 
01:43 Jun 28, 2020
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H6866.IH
H6866
kjohnson on DSK79L0C42PROD with BILLS
(C) DESTRUCTION.—Not later than 30 
days after the receipt of an individual’s revoca-
tion of consent, a covered organization shall de-
stroy or render not linkable that individuals 
emergency health data under the same proce-
dures in subsection (f). 
(e) NOTICE.—A covered organization that collects, 
uses, or discloses emergency health data shall provide to 
an individual a privacy policy that— 
(1) is disclosed in a clear and conspicuous man-
ner, in the language in which the individual typically 
interacts with the covered organization, prior to or 
at the point of the collection of emergency health 
data; 
(2) describes how and for what purposes the 
covered organization collects, uses, and discloses 
emergency health data, including the categories of 
recipients to whom it discloses data and the purpose 
of disclosure for each category; 
(3) describes the covered organization’s data re-
tention and data security policies and practices for 
emergency health data; and 
(4) describes how an individual may exercise 
the rights under this Act and how to contact the 
Commission to file a complaint. 
VerDate Sep 11 2014 
01:43 Jun 28, 2020
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H6866.IH
H6866
kjohnson on DSK79L0C42PROD with BILLS
(f) PUBLIC REPORTING.— 
(1) IN GENERAL.—A covered organization that 
collects, uses, or discloses emergency health data of 
at least 100,000 individuals shall, at least once every 
90 days, issue a public report— 
(A) stating in aggregate terms the number 
of individuals whose emergency health data the 
covered organization collected, used, or dis-
closed to the extent practicable; and 
(B) describing the categories of emergency 
health data collected, used, or disclosed, the 
purposes for which each such category of emer-
gency health data was collected, used, or dis-
closed, and the categories of third parties to 
whom it was disclosed. 
(2) RULES
OF
CONSTRUCTION.—Nothing in 
this subsection shall be construed to require a cov-
ered organization to— 
(A) take an action that would convert data 
that is not emergency health data into emer-
gency health data; 
(B) collect or maintain emergency health 
data that the covered organization would other-
wise not maintain; or 
VerDate Sep 11 2014 
01:43 Jun 28, 2020
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H6866.IH
H6866
kjohnson on DSK79L0C42PROD with BILLS
(C) maintain emergency health data longer 
than the covered organization would otherwise 
maintain such data. 
(g) REQUIRED DATA DESTRUCTION.— 
(1) IN GENERAL.—A covered organization may 
not use or maintain emergency health data of an in-
dividual after the later of— 
(A) the date that is 60 days after the ter-
mination of the public health emergency de-
clared by the Secretary on January 31, 2020, 
pertaining 
to 
Coronavirus 
Disease 
2019 
(COVID–19) under section 319 of Public 
Health Service Act (42 U.S.C. 247d) and any 
renewals thereof; 
(B) the date that is 60 days after the ter-
mination of a public health emergency declared 
by a governor or chief executive of a State per-
taining to Coronavirus Disease 2019 (COVID– 
19) in which the individual resides; or 
(C) 60 days after collection. 
(2) 
REQUIREMENT.—For 
the 
requirements 
under paragraph (1), data shall be destroyed or ren-
dered not linkable in such a manner that it is impos-
sible or demonstrably impracticable to identify any 
individual from the data. 
VerDate Sep 11 2014 
01:43 Jun 28, 2020
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H6866.IH
H6866
kjohnson on DSK79L0C42PROD with BILLS
(3) RELATION TO CERTAIN REQUIREMENTS.— 
The provisions of this subsection shall not supersede 
any requirements or authorizations under— 
(A) the Privacy Act of 1974 (Public Law 
93–79); 
(B) the HIPAA regulations; or 
(C) Federal or State medical records reten-
tion and health privacy laws or regulations, or 
other applicable Federal or State laws. 
(h) EMERGENCY DATA COLLECTED, USED, OR DIS-
CLOSED BEFORE ENACTMENT.— 
(1) INITIATING
A
RULEMAKING.—Not later 
than 7 days after the date of enactment of this Act, 
the Commission shall initiate a public rulemaking to 
promulgate regulations to ensure a covered organiza-
tion that has collected, used, or disclosed emergency 
health data before the date of enactment of this Act 
is in compliance with this Act, to the degree prac-
ticable. 
(2) COMPLETING A RULEMAKING.—The Com-
mission shall complete the rulemaking within 45 
days after the date of enactment of this Act. 
(i) NON-APPLICATION TO MANUAL CONTACT TRAC-
ING AND CASE INVESTIGATION.—Nothing in this Act shall 
be construed to limit or prohibit a public health authority 
VerDate Sep 11 2014 
22:27 Jun 28, 2020
Jkt 099200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H6866.IH
H6866
kjohnson on DSK79L0C42PROD with BILLS
from administering programs or activities to identify indi-
viduals who have contracted, or may have been exposed 
to, COVID–19 through interviews, outreach, case inves-
tigation, and other recognized investigatory measures by 
a public health authority or their designated agent by a 
public health authority or their designated agent intended 
to monitor and mitigate the transmission of a disease or 
disorder. 
(j) RESEARCH
AND DEVELOPMENT.—This section 
shall not be construed to prohibit— 
(1) public health or scientific research associ-
ated with the COVID–19 public health emergency 
by— 
(A) a public health authority; 
(B) a nonprofit organization, as described 
in section 501(c)(3) of the Internal Revenue 
Code of 1986; or 
(C) an institution of higher education, as 
such term is defined in section 101 of the High-
er Education Act of 1965 (20 U.S.C. 1001); or 
(2) research, development, manufacture, or dis-
tribution of a drug, biological product, or vaccine 
that relates to a disease or disorder that is associ-
ated or potentially associated with a public health 
emergency. 
VerDate Sep 11 2014 
01:43 Jun 28, 2020
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H6866.IH
H6866
kjohnson on DSK79L0C42PROD with BILLS
(k) LEGAL REQUIREMENTS.—Notwithstanding sub-
section (a)(5), nothing in this Act shall be construed to 
prohibit a good faith response to, or compliance with, oth-
erwise valid subpoenas, court orders, or other legal proc-
esses, or to prohibit storage or providing information as 
otherwise required by law. 
(l) APPLICATION TO HIPAA COVERED ENTITIES.— 
(1) IN GENERAL.—This Act does not apply to 
a ‘‘covered entity’’ or a person acting as a ‘‘business 
associate’’ under the HIPAA regulations (to the ex-
tent that such entities or associates are acting in 
such capacity) or any health care provider. 
(2) GUIDANCE FOR CONSISTENCY.—Not later 
than 30 days after the date of enactment of this 
Act, the Secretary shall promulgate guidance on the 
applicability of requirements, similar to those in this 
section to ‘‘covered entities’’ and persons acting as 
‘‘business associates’’ under the HIPAA regulations. 
In promulgating such guidance, the Secretary shall 
reduce duplication of requirements and may exclude 
a requirement of this section if such requirement is 
already a requirement of the HIPAA regulations. 
SEC. 4. PROTECTING THE RIGHT TO VOTE. 
(a) IN GENERAL.—A government entity may not, and 
a covered organization may not knowingly facilitate, on 
VerDate Sep 11 2014 
01:43 Jun 28, 2020
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H6866.IH
H6866
kjohnson on DSK79L0C42PROD with BILLS
the basis of an individual’s emergency health data, medical 
condition, or participation or non-participation in a pro-
gram to collect emergency health data— 
(1) deny, restrict, or interfere with the right to 
vote in a Federal, State, or local election; 
(2) attempt to deny, restrict, or interfere with 
the right to vote in a Federal, State, or local elec-
tion; or 
(3) retaliate against an individual for voting in 
a Federal, State, or local election. 
(b) CIVIL ACTION.—In the case of any violation of 
subsection (a), an individual may bring a civil action to 
obtain appropriate relief against a government entity in 
a Federal district court. 
SEC. 5. REPORTS ON CIVIL RIGHTS IMPACTS. 
(a) REPORT REQUIRED.—The Secretary, in consulta-
tion with the United States Commission on Civil Rights 
and the Commission, shall prepare and submit to Con-
gress reports that examines the civil rights impact of the 
collection, use, and disclosure of health information in re-
sponse to the COVID–19 public health emergency. 
(b) SCOPE OF REPORT.—Each report required under 
subsection (a) shall, at a minimum— 
(1) evaluate the impact of such practices on 
civil rights and protections for individuals based on 
VerDate Sep 11 2014 
01:43 Jun 28, 2020
Jkt 099200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H6866.IH
H6866
kjohnson on DSK79L0C42PROD with BILLS