Health Information Privacy Reform Act

Key Points

• The bill creates new federal privacy, security, and breach notification rules for health data collected by apps, wellness devices, and other companies not currently covered by HIPAA.
• Companies must tell users in plain language when their health data will no longer be protected under HIPAA-style rules and must get consent before selling that data to third parties.
• Users of wellness apps and devices, like step counters and fitness trackers, must be notified in advance and given the choice to opt out of having their wellness data generated at all.
• The bill orders a National Academies study on whether patients should be compensated for letting researchers use their identifiable health data, and on the risk that supposedly anonymous data could be traced back to a specific person.
• HHS must create unified national standards for stripping identifying details from health data, and any company receiving de-identified data must sign a written promise not to try to re-identify the people in it.
• The new federal rules would preempt conflicting state health privacy laws in the same way HIPAA already preempts weaker state medical privacy protections.