I 
117TH CONGRESS 
1ST SESSION 
H. R. 651 
To protect the privacy of health information during a national health 
emergency. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 1, 2021 
Ms. ESHOO (for herself, Ms. SCHAKOWSKY, Ms. DELBENE, Mr. BEYER, Mr. 
MCNERNEY, Ms. BARRAGA´N, Mr. POCAN, Mr. RUSH, Mr. WELCH, Ms. 
SCANLON, Ms. MATSUI, Mr. LIEU, Mr. DESAULNIER, Mrs. HAYES, Mr. 
KHANNA, Mr. GARCI´A of Illinois, Mr. LYNCH, Mr. GRIJALVA, Ms. LEE 
of California, Mrs. DINGELL, Mr. DEFAZIO, Mr. JOHNSON of Georgia, 
and Ms. PORTER) introduced the following bill; which was referred to the 
Committee on Energy and Commerce 
A BILL 
To protect the privacy of health information during a 
national health emergency. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Public Health Emer-
gency Privacy Act’’. 
SEC. 2. DEFINITIONS. 
In this Act: 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
(1) AFFIRMATIVE
EXPRESS
CONSENT.—The 
term ‘‘affirmative express consent’’ means an affirm-
ative act by an individual that— 
(A) clearly and conspicuously commu-
nicates the individual’s authorization of an act 
or practice; 
(B) is made in the absence of any mecha-
nism in the user interface that has the purpose 
or substantial effect of obscuring, subverting, or 
impairing decision making or choice to obtain 
consent; and 
(C) cannot be inferred from inaction. 
(2) COLLECT.—The term ‘‘collect’’, with re-
spect to emergency health data, means obtaining in 
any manner by a covered organization. 
(3) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(4) COVERED ORGANIZATION.— 
(A) IN GENERAL.—The term ‘‘covered or-
ganization’’ means any person (including a gov-
ernment entity)— 
(i) that collects, uses, or discloses 
emergency health data electronically or 
through communication by wire or radio; 
or 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
(ii) that develops or operates a 
website, web application, mobile applica-
tion, mobile operating system feature, or 
smart device application for the purpose of 
tracking, screening, monitoring, contact 
tracing, or mitigation, or otherwise re-
sponding to the COVID–19 public health 
emergency. 
(B) EXCLUSIONS.—The term ‘‘covered or-
ganization’’ does not include— 
(i) a health care provider; 
(ii) a person engaged in a de minimis 
collection or processing of emergency 
health data; 
(iii) a service provider; 
(iv) a person acting in their individual 
or household capacity; or 
(v) a public health authority. 
(5) DEMOGRAPHIC
DATA.—The term ‘‘demo-
graphic data’’ means information relating to the ac-
tual or perceived race, color, ethnicity, national ori-
gin, religion, sex, gender, gender identity, sexual ori-
entation, age, Tribal affiliation, disability, domicile, 
employment status, familial status, immigration sta-
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
tus, or veteran status of an individual or group of 
individuals. 
(6) DEVICE.—The term ‘‘device’’ means any 
electronic equipment that is primarily designed for 
or marketed to consumers. 
(7) DISCLOSURE.—The term ‘‘disclosure’’, with 
respect to emergency health data, means the releas-
ing, transferring, selling, providing access to, licens-
ing, or divulging in any manner by a covered organi-
zation to a third party. 
(8) EMERGENCY
HEALTH
DATA.—The term 
‘‘emergency health data’’ means data linked or rea-
sonably linkable to an individual or device, including 
data inferred or derived about the individual or de-
vice from other collected data provided such data is 
still linked or reasonably linkable to the individual or 
device, that concerns the public COVID–19 health 
emergency. Such data includes— 
(A) information that reveals the past, 
present, or future physical or behavioral health 
or condition of, or provision of healthcare to, an 
individual, including— 
(i) data derived from the testing or 
examination of a body part or bodily sub-
stance, or a request for such testing; 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
(ii) whether or not an individual has 
contracted or been tested for, or an esti-
mate of the likelihood that a particular in-
dividual may contract, such disease or dis-
order; and 
(iii) genetic data, biological samples, 
and biometrics; and 
(B) other data collected in conjunction 
with other emergency health data or for the 
purpose of tracking, screening, monitoring, con-
tact tracing, or mitigation, or otherwise re-
sponding to the COVID–19 public health emer-
gency, including— 
(i) geolocation data, when such term 
means data capable of determining the 
past or present precise physical location of 
an individual at a specific point in time, 
taking account of population densities, in-
cluding cell-site location information, tri-
angulation data derived from nearby wire-
less or radio frequency networks, and glob-
al positioning system data; 
(ii) proximity data, when such term 
means information that identifies or esti-
mates the past or present physical prox-
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
imity of one individual or device to an-
other, including information derived from 
Bluetooth, audio signatures, nearby wire-
less networks, and near-field communica-
tions; 
(iii) demographic data; 
(iv) contact information for identifi-
able individuals or a history of the individ-
ual’s contacts over a period of time, such 
as an address book or call log; and 
(v) any other data collected from a 
personal device. 
(9) GOVERNMENT ENTITY.—The term ‘‘govern-
ment entity’’ includes a Federal agency, a State, a 
local government, and other organizations, as such 
terms are defined in section 3371 of title 5, United 
States Code. 
(10) HEALTH
CARE
PROVIDER.—The term 
‘‘health care provider’’ has the meaning given the 
term ‘‘eligible health care provider’’ in title VIII of 
division B the CARES Act (Public Law 116–136). 
(11) 
HIPAA 
REGULATIONS.—The 
term 
‘‘HIPAA regulations’’ means parts 160 and 164 of 
title 45, Code of Federal Regulations. 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
(12) PUBLIC HEALTH AUTHORITY.—The term 
‘‘public health authority’’ means an entity that is 
authorized by law to collect or receive information 
for the purpose of preventing or controlling disease, 
injury, or disability including, but not limited to, the 
reporting of disease, injury, vital events such as 
birth or death, and the conduct of public health sur-
veillance, public health investigations, and public 
health interventions, and a person, such as a des-
ignated agency or associate, acting under a grant of 
authority from, or under a contract with, such public 
entity, including the employees or agents of such en-
tity or its contractors or persons or entities to whom 
it has granted authority. 
(13) 
COVID–19 
PUBLIC
HEALTH
EMER-
GENCY.—The term ‘‘COVID–19 public health emer-
gency’’ means the outbreak and public health re-
sponse pertaining to Coronavirus Disease 2019 
(COVID–19), associated with the emergency de-
clared by the Secretary on January 31, 2020, under 
section 319 of the Public Health Service Act (42 
U.S.C. 247d), and any renewals thereof and any 
subsequent declarations by the Secretary related to 
the coronavirus. 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
(14) 
SECRETARY.—The 
term 
‘‘Secretary’’ 
means the Secretary of Health and Human Services. 
(15) SERVICE PROVIDER.— 
(A) IN GENERAL.—The term ‘‘service pro-
vider’’ means a person that collects, uses, or 
discloses emergency health data for the sole 
purpose of, and only to the extent that such en-
tity is, conducting business activities on behalf 
of, for the benefit of, under instruction of, and 
under contractual agreement with a covered or-
ganization. 
(B) LIMITATION OF APPLICATION.—Such 
person shall only be considered a service pro-
vider in the course of activities described in 
subparagraph (A). 
(C) EXCLUSIONS.—The term ‘‘service pro-
vider’’ excludes a person that develops or oper-
ates a website, web application, mobile applica-
tion, or smart device application for the purpose 
of tracking, screening, monitoring, contact trac-
ing, or mitigation, or otherwise responding to 
the COVID–19 public health emergency. 
(16) STATE.—The term ‘‘State’’ means each 
State of the United States, the District of Columbia, 
each commonwealth, territory, or possession of the 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
United States, and each federally recognized Indian 
Tribe. 
(17) THIRD PARTY.— 
(A) IN GENERAL.—The term ‘‘third party’’ 
means, with respect to a covered organization— 
(i) another person to whom such cov-
ered 
organization 
disclosed 
emergency 
health data; and 
(ii) a corporate affiliate or a related 
party of the covered organization that does 
not have a direct relationship with an indi-
vidual with whom the emergency health 
data is linked or is reasonably linkable. 
(B) EXCLUSION.—The term ‘‘third party’’ 
excludes, with respect to a covered organiza-
tion— 
(i) a service provider of such covered 
organization; or 
(ii) a public health authority. 
(18) USE.—The term ‘‘use’’, with respect to 
emergency health data, means the processing, em-
ployment, application, utilization, examination, or 
analysis of such data by a covered organization that 
maintains such data. 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
SEC. 3. PROTECTING THE PRIVACY AND SECURITY OF 
EMERGENCY HEALTH DATA. 
(a) RIGHT TO PRIVACY.—A covered organization that 
collects emergency health data shall— 
(1) only collect, use, or disclose such data that 
is necessary, proportionate, and limited for a good 
faith public health purpose, including a service or 
feature to support such a purpose; 
(2) take reasonable measures, where possible, to 
ensure the accuracy of emergency health data and 
provide an effective mechanism for an individual to 
correct inaccurate information; 
(3) adopt reasonable safeguards to prevent un-
lawful discrimination on the basis of emergency 
health data; and 
(4) only disclose such data to a government en-
tity when the disclosure— 
(A) is to a public health authority; and 
(B) is made solely for good faith public 
health purposes and in direct response to exi-
gent circumstances. 
(b) RIGHT TO SECURITY.—A covered organization or 
service provider that collects, uses, or discloses emergency 
health data shall establish and implement reasonable data 
security policies, practices, and procedures to protect the 
security and confidentiality of emergency health data. 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
(c) PROHIBITED USES.—A covered organization shall 
not collect, use, or disclose emergency health data for any 
purpose not authorized under this section, including— 
(1) commercial advertising, recommendation for 
e-commerce, or the training of machine-learning al-
gorithms related to, or subsequently for use in, com-
mercial advertising and e-commerce; 
(2) soliciting, offering, selling, leasing, licensing, 
renting, advertising, marketing, or otherwise com-
mercially contracting for employment, finance, cred-
it, insurance, housing, or education opportunities in 
a manner that discriminates or otherwise makes op-
portunities unavailable on the basis of emergency 
health data; and 
(3) segregating, discriminating in, or otherwise 
making unavailable the goods, services, facilities, 
privileges, advantages, or accommodations of any 
place of public accommodation (as such term is de-
fined in section 301 of the Americans With Disabil-
ities Act of 1990 (42 U.S.C. 12181)), except as au-
thorized by a State or Federal Government entity 
for a public health purpose notwithstanding sub-
section (g). 
(d) CONSENT.— 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
(1) IN GENERAL.—It shall be unlawful for a 
covered organization to collect, use, or disclose emer-
gency health data, unless— 
(A) the individual to whom the data per-
tains has given affirmative express consent to 
such collection, use, or disclosure; 
(B) such collection, use, or disclosure is 
necessary and for the sole purpose of— 
(i) protecting against malicious, de-
ceptive, fraudulent, or illegal activity; or 
(ii) detecting, responding to, or pre-
venting information security incidents or 
threats; or 
(C) the covered organization is compelled 
to do so by a legal obligation. 
(2) REVOCATION.— 
(A) IN GENERAL.—A covered organization 
shall provide an effective mechanism for an in-
dividual to revoke consent after it is given. 
(B) EFFECT.—After an individual revokes 
consent, the covered organization shall cease 
collecting, using, or disclosing the individual’s 
emergency health data as soon as practicable, 
but in no case later than 15 days after the re-
ceipt of the individual’s revocation of consent. 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
(C) DESTRUCTION.—Not later than 30 
days after the receipt of an individual’s revoca-
tion of consent, a covered organization shall de-
stroy or render not linkable that individual’s 
emergency health data under the same proce-
dures in subsection (f). 
(e) NOTICE.—A covered organization that collects, 
uses, or discloses emergency health data shall provide to 
an individual a privacy policy that— 
(1) is disclosed in a clear and conspicuous man-
ner, in the language in which the individual typically 
interacts with the covered organization, prior to or 
at the point of the collection of emergency health 
data; 
(2) describes how and for what purposes the 
covered organization collects, uses, and discloses 
emergency health data, including the categories of 
recipients to whom it discloses data and the purpose 
of disclosure for each category; 
(3) describes the covered organization’s data re-
tention and data security policies and practices for 
emergency health data; and 
(4) describes how an individual may exercise 
the rights under this Act and how to contact the 
Commission to file a complaint. 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
(C) maintain emergency health data longer 
than the covered organization would otherwise 
maintain such data. 
(g) REQUIRED DATA DESTRUCTION.— 
(1) IN GENERAL.—A covered organization may 
not use or maintain emergency health data of an in-
dividual after the later of— 
(A) the date that is 60 days after the ter-
mination of the public health emergency de-
clared by the Secretary on January 31, 2020, 
pertaining 
to 
Coronavirus 
Disease 
2019 
(COVID–19) under section 319 of Public 
Health Service Act (42 U.S.C. 247d) and any 
renewals thereof; 
(B) the date that is 60 days after the ter-
mination of a public health emergency declared 
by a governor or chief executive of a State per-
taining to Coronavirus Disease 2019 (COVID– 
19) in which the individual resides; or 
(C) 60 days after collection. 
(2) 
REQUIREMENT.—For 
the 
requirements 
under paragraph (1), data shall be destroyed or ren-
dered not linkable in such a manner that it is impos-
sible or demonstrably impracticable to identify any 
individual from the data. 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
(3) RELATION TO CERTAIN REQUIREMENTS.— 
The provisions of this subsection shall not supersede 
any requirements or authorizations under— 
(A) the Privacy Act of 1974 (Public Law 
93–79); 
(B) the HIPAA regulations; or 
(C) Federal or State medical records reten-
tion and health privacy laws or regulations, or 
other applicable Federal or State laws. 
(h) EMERGENCY DATA COLLECTED, USED, OR DIS-
CLOSED BEFORE ENACTMENT.— 
(1) INITIATING
A
RULEMAKING.—Not later 
than 7 days after the date of enactment of this Act, 
the Commission shall initiate a public rulemaking to 
promulgate regulations to ensure a covered organiza-
tion that has collected, used, or disclosed emergency 
health data before the date of enactment of this Act 
is in compliance with this Act, to the degree prac-
ticable. 
(2) COMPLETING A RULEMAKING.—The Com-
mission shall complete the rulemaking within 45 
days after the date of enactment of this Act. 
(i) NON-APPLICATION TO MANUAL CONTACT TRAC-
ING AND CASE INVESTIGATION.—Nothing in this Act shall 
be construed to limit or prohibit a public health authority 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
from administering programs or activities to identify indi-
viduals who have contracted, or may have been exposed 
to, COVID–19 through interviews, outreach, case inves-
tigation, and other recognized investigatory measures by 
a public health authority or their designated agent in-
tended to monitor and mitigate the transmission of a dis-
ease or disorder. 
(j) RESEARCH
AND DEVELOPMENT.—This section 
shall not be construed to prohibit— 
(1) public health or scientific research associ-
ated with the COVID–19 public health emergency 
by— 
(A) a public health authority; 
(B) a nonprofit organization, as described 
in section 501(c)(3) of the Internal Revenue 
Code of 1986; or 
(C) an institution of higher education, as 
such term is defined in section 101 of the High-
er Education Act of 1965 (20 U.S.C. 1001); or 
(2) research, development, manufacture, or dis-
tribution of a drug, biological product, or vaccine 
that relates to a disease or disorder that is associ-
ated or potentially associated with a public health 
emergency. 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
(k) LEGAL REQUIREMENTS.—Notwithstanding sub-
section (a)(5), nothing in this Act shall be construed to 
prohibit a good faith response to, or compliance with, oth-
erwise valid subpoenas, court orders, or other legal proc-
esses, or to prohibit storage or providing information as 
otherwise required by law. 
(l) APPLICATION TO HIPAA COVERED ENTITIES.— 
(1) IN GENERAL.—This Act does not apply to 
a ‘‘covered entity’’ or a person acting as a ‘‘business 
associate’’ under the HIPAA regulations (to the ex-
tent that such entities or associates are acting in 
such capacity) or any health care provider. 
(2) GUIDANCE FOR CONSISTENCY.—Not later 
than 30 days after the date of enactment of this 
Act, the Secretary shall promulgate guidance on the 
applicability of requirements, similar to those in this 
section to ‘‘covered entities’’ and persons acting as 
‘‘business associates’’ under the HIPAA regulations. 
In promulgating such guidance, the Secretary shall 
reduce duplication of requirements and may exclude 
a requirement of this section if such requirement is 
already a requirement of the HIPAA regulations. 
SEC. 4. PROTECTING THE RIGHT TO VOTE. 
(a) IN GENERAL.—A government entity may not, and 
a covered organization may not knowingly facilitate, on 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
the basis of an individual’s emergency health data, medical 
condition, or participation or non-participation in a pro-
gram to collect emergency health data— 
(1) deny, restrict, or interfere with the right to 
vote in a Federal, State, or local election; 
(2) attempt to deny, restrict, or interfere with 
the right to vote in a Federal, State, or local elec-
tion; or 
(3) retaliate against an individual for voting in 
a Federal, State, or local election. 
(b) CIVIL ACTION.—In the case of any violation of 
subsection (a), an individual may bring a civil action to 
obtain appropriate relief against a government entity in 
a Federal district court. 
SEC. 5. REPORTS ON CIVIL RIGHTS IMPACTS. 
(a) REPORT REQUIRED.—The Secretary, in consulta-
tion with the United States Commission on Civil Rights 
and the Commission, shall prepare and submit to Con-
gress reports that examines the civil rights impact of the 
collection, use, and disclosure of health information in re-
sponse to the COVID–19 public health emergency. 
(b) SCOPE OF REPORT.—Each report required under 
subsection (a) shall, at a minimum— 
(1) evaluate the impact of such practices on 
civil rights and protections for individuals based on 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS
(i) the district court of the United 
States that meets applicable requirements 
relating to venue under section 1391 of 
title 28, United States Code; or 
(ii) another court of competent juris-
diction. 
(B) SERVICE OF PROCESS.—In an action 
brought under paragraph (1), process may be 
served in any district in which the defendant— 
(i) is an inhabitant; or 
(ii) may be found. 
(C) ACTIONS
BY
OTHER
STATE
OFFI-
CIALS.— 
(i) IN GENERAL.—In addition to civil 
actions brought by attorneys general under 
paragraph (1), any other officer of a State 
who is authorized by the State to do so 
may bring a civil action under paragraph 
(1), subject to the same requirements and 
limitations that apply under this sub-
section to civil actions brought by attor-
neys general. 
(ii) SAVINGS PROVISION.—Nothing in 
this subsection may be construed to pro-
hibit an authorized official of a State from 
VerDate Sep 11 2014 
04:15 Mar 19, 2021
Jkt 019200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H651.IH
H651
pbinns on DSKJLVW7X2PROD with BILLS