I 
116TH CONGRESS 
2D SESSION 
H. R. 7472 
To authorize the Director of the Centers for Disease Control and Prevention 
to award grants to eligible State, Tribal, and territorial public health 
agencies to develop and administer a program for digital contact tracing 
for COVID–19, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 1, 2020 
Ms. SPEIER (for herself, Ms. DEGETTE, Mrs. DINGELL, Mr. CARSON of Indi-
ana, Ms. BARRAGA´N, Mr. LYNCH, Mr. RASKIN, Mr. SAN NICOLAS, Mr. 
TAKANO, and Mr. HASTINGS) introduced the following bill; which was re-
ferred to the Committee on Energy and Commerce 
A BILL 
To authorize the Director of the Centers for Disease Control 
and Prevention to award grants to eligible State, Tribal, 
and territorial public health agencies to develop and ad-
minister a program for digital contact tracing for 
COVID–19, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Secure Data and Pri-
vacy for Contact Tracing Act of 2020’’. 
VerDate Sep 11 2014 
04:52 Jul 27, 2020
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H7472.IH
H7472
pbinns on DSKJLVW7X2PROD with BILLS
SEC. 2. GRANT PROGRAM FOR DIGITAL CONTACT TRACING 
FOR COVID–19. 
(a) IN GENERAL.—The Director of the Centers for 
Disease Control and Prevention shall award grants to eli-
gible State, Tribal, and territorial public health agencies 
to— 
(1) establish a contact-tracing program that im-
plements traditional contact tracing protocols with 
the assistance of digital contact tracing technology 
to track and prevent the spread of COVID–19; or 
(2) incorporate digital contact tracing tech-
nology into a contact-tracing program that imple-
ments traditional contact tracing protocols to track 
and prevent the spread of COVID–19. 
(b) FUNDING DISQUALIFICATION.—If a State, Trib-
al, or territorial public health agency develops or procures 
any digital contact tracing technology with respect to 
COVID–19 that does not meet each of the requirements 
listed in subsection (c), such State, Tribal, or territorial 
public health agency shall be ineligible to receive or con-
tinue to receive— 
(1) any funds through a grant under this sec-
tion; and 
(2) any other Federal funds, including under 
the CARES Act (Public Law 116–136), for any dig-
VerDate Sep 11 2014 
04:52 Jul 27, 2020
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H7472.IH
H7472
pbinns on DSKJLVW7X2PROD with BILLS
ital contact-tracing technology with respect to 
COVID–19. 
(c) DIGITAL CONTACT-TRACING REQUIREMENTS.—A 
State, Tribal, or territorial public health agency may use 
a grant under this section for digital contact tracing tech-
nology, as described in subsection (a), only if the tech-
nology meets each of the following requirements: 
(1) The technology shall be voluntary for the 
user and provide to the user complete and clear in-
formation on the intended use and processing of 
data collected by the technology. To be voluntary for 
the user, the technology shall meet requirements in-
cluding each of the following: 
(A) Use of the technology and of contact- 
tracing data collected using the technology shall 
be predicated on the user’s affirmative consent. 
(B) Use of the technology shall not be a 
condition for the reception of government bene-
fits. 
(C) Use of the technology shall not be 
made a condition of employment or employment 
status. 
(2) The technology shall limit the collection of 
data by the technology to only the data that is nec-
VerDate Sep 11 2014 
04:52 Jul 27, 2020
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H7472.IH
H7472
pbinns on DSKJLVW7X2PROD with BILLS
essary to meet contact-tracing objectives, includ-
ing— 
(A) the status of any person as an infected 
or potentially infected person; and 
(B) the proximity of a person to someone 
who is symptomatic or has tested positive. 
(3) The technology— 
(A) shall delete or de-identify any contact- 
tracing data that is individually identifiable in-
formation not later than the date that is 30 
days after the end of the COVID–19 emergency 
declaration; and 
(B) shall include notifications to prompt 
users to disable or completely remove any dig-
ital contact-tracing technology where practical. 
(4) The technology shall have robust contact 
detection specifications, including for distance and 
time, that allow for detection consistent with guid-
ance of the Centers for Disease Control and Preven-
tion on COVID–19. 
(5) The technology shall ensure that the storing 
of proximity and any contact-tracing data is 
encrypted to the maximum extent possible. 
VerDate Sep 11 2014 
04:52 Jul 27, 2020
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H7472.IH
H7472
pbinns on DSKJLVW7X2PROD with BILLS
(d) PLAN FOR INTEROPERABILITY.—As a condition 
on receipt of a grant under this section, a State, Tribal, 
or territorial public health agency shall— 
(1) develop and make publicly available a plan 
for how the digital contact-tracing technology of the 
agency with respect to COVID–19 augments— 
(A) traditional contact tracing efforts, if 
applicable; and 
(B) statewide efforts to prevent, prepare 
for, and respond to COVID–19; and 
(2) include in such plan a description of the 
agency’s efforts to ensure that the digital contact- 
tracing technologies of the agency with respect to 
COVID–19 are interoperable with the digital con-
tact-tracing technology and public health agency 
databases of other jurisdictions with respect to 
COVID–19; and 
(3) ensure that data collected by the digital 
contact-tracing technology of the agency— 
(A) is accessed and processed only by pub-
lic health authorities (or their designees); and 
(B) is not shared with any person, or 
accessed or used by any person, for any purpose 
other than diagnosis, containment, treatment, 
or reduction of, or research into, COVID–19. 
VerDate Sep 11 2014 
04:52 Jul 27, 2020
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H7472.IH
H7472
pbinns on DSKJLVW7X2PROD with BILLS
(e) INDEPENDENT SECURITY ASSESSMENTS.— 
(1) IN GENERAL.—As a condition on receipt of 
a grant under this section, a State, Tribal, or terri-
torial public health agency shall— 
(A) establish procedures for completing or 
obtaining independent security assessments of 
digital contact-tracing infrastructure to ensure 
that physical and network security is resilient 
and secure; and 
(B) develop a process to address the miti-
gation 
or 
remediation 
of 
the 
security 
vulnerabilities discovered during such inde-
pendent security assessments. 
(2) SOURCE CODE.—A State, Tribal, or terri-
torial public health agency should consider making 
public the source code of the digital contact-tracing 
technology used by the agency. 
(f) APPLICATION.—To seek a grant under this sec-
tion, an eligible State, Tribal, or territorial public health 
agency shall submit an application in such form, in such 
manner, and containing such information and assurances 
as the Director may require. 
(g) SECURING DIGITAL CONTACT-TRACING DATA.— 
(1) IN
GENERAL.—The provisions of the 
HIPAA privacy and security law (as defined in sec-
VerDate Sep 11 2014 
04:52 Jul 27, 2020
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H7472.IH
H7472
pbinns on DSKJLVW7X2PROD with BILLS
tion 3009(a)(2) of the Public Health Service Act (42 
U.S.C. 300jj–19(a)(2))) shall apply to a State, Trib-
al, or territorial public health agency receiving a 
grant under subsection (a) with respect to individ-
ually identifiable health information (as defined in 
section 1171(a)(6) of the Social Security Act (42 
U.S.C. 1320d(a)(6))) received by, maintained on, or 
transmitted through a contact-tracing program de-
scribed in such subsection (a) in the same manner 
as such provisions apply with respect to such infor-
mation and a covered entity (as defined in section 
13400(3) 
of 
the 
HITECH 
Act 
(42 
U.S.C. 
17921(3))). 
(2) BUSINESS ASSOCIATES.— 
(A) IN GENERAL.—Any entity with a con-
tract in effect with an agency described in para-
graph (1) for the development, maintenance, or 
operation of a program described in such para-
graph shall be deemed to be a business asso-
ciate of such agency for purposes of subtitle D 
of the HITECH Act (42 U.S.C. 17921 et seq.). 
(B) REVISION OF SAMPLE AGREEMENT.— 
Not later than 180 days after the date of the 
enactment of this Act, the Secretary shall revise 
the sample business associate agreement provi-
VerDate Sep 11 2014 
04:52 Jul 27, 2020
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H7472.IH
H7472
pbinns on DSKJLVW7X2PROD with BILLS
sions published on January 25, 2013, to take 
account of the provisions of this subsection. 
(C) EFFECTIVE DATE.—The provisions of 
subparagraph (A) shall apply beginning on the 
day after the Secretary revises the provisions 
described in subparagraph (B). 
(h) LIMITATION ON USE OF DATA.—Data generated 
in connection with the operation of digital contact tracing 
technology funded pursuant to this section may not be 
used for any punitive purpose, including law enforcement, 
immigration enforcement, or criminal prosecution. Such 
data and any information derived from it, whether in 
whole or in part, may not be received as evidence in any 
trial, hearing, or other proceeding in or before any court, 
grand jury, department, officer, agency, regulatory body, 
legislative committee, or other authority of the United 
States, a State, or a political subdivision thereof. 
(i) REPORT TO CONGRESS.—Not later than 90 days 
after the date of enactment of this Act, the Comptroller 
General of the United States shall— 
(1) evaluate the outcome of the grants awarded 
under this section, including an assessment of the 
impact of the implementation of digital contact-trac-
ing programs funded through such grants on the 
spread of COVID–19; and 
VerDate Sep 11 2014 
04:52 Jul 27, 2020
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H7472.IH
H7472
pbinns on DSKJLVW7X2PROD with BILLS
(2) submit to the Congress a report on the re-
sults of such evaluation. 
(j) DEFINITIONS.—In this section: 
(1) AFFIRMATIVE
EXPRESS
CONSENT.—The 
term ‘‘affirmative express consent’’ means an affirm-
ative act by an individual that clearly and conspicu-
ously communicates the individual’s authorization 
for an act or practice, in response to a specific re-
quest that— 
(A) is provided to the individual in a clear 
and conspicuous disclosure that is separate 
from other options or acceptance of general 
terms; 
(B) includes a description of each act or 
practice for which the individual’s consent is 
sought and— 
(i) is written clearly and unmistakably 
stated; and 
(ii) includes a prominent heading that 
would enable a reasonable individual to 
identify and understand the act or prac-
tice; and 
(C) cannot be inferred from inaction. 
VerDate Sep 11 2014 
04:52 Jul 27, 2020
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H7472.IH
H7472
pbinns on DSKJLVW7X2PROD with BILLS