What's Happening?
Senator Maggie Hassan of New Hampshire has co-sponsored the Health Information Privacy Reform Act, a federal bill aimed at bringing wearable health data and consumer health apps under HIPAA-style protections. The Senate HELP Committee unanimously voted
22-0 to advance this bill, which seeks to close the gap between existing federal privacy law and the increasing volume of health data generated by smartwatches, rings, and smartphone applications. Currently, HIPAA protections apply to 'covered entities' like hospitals, but not directly to the data itself when it resides in consumer devices or apps. The proposed legislation would create a new category of 'regulated entities,' including wearable makers, health app developers, data brokers, and cash-pay providers that do not bill insurance, subjecting them to privacy, security, and breach-notification standards at least equivalent to HIPAA's. Individuals would gain rights to privacy notices, access, amendment, deletion, and data portability for their health information.
Why It's Important?
This legislation is important because it addresses a significant gap in health data privacy in the digital age. As more individuals use wearable technology and health apps, a vast amount of personal health information is being collected outside the traditional healthcare system, where HIPAA protections do not apply. This leaves consumers vulnerable to potential misuse or unauthorized sharing of their sensitive health data. By extending HIPAA-style rules to these 'regulated entities,' the bill aims to provide a consistent level of privacy and security for health data, regardless of where it is stored or generated. This could build greater trust in digital health technologies and encourage their adoption, while also protecting individuals from data breaches and privacy violations. The bipartisan support for the bill, evidenced by the unanimous committee vote and Senator Hassan's co-sponsorship, highlights a growing recognition of the need for updated privacy frameworks in response to technological advancements.
What's Next?
While the Health Information Privacy Reform Act has advanced through the Senate HELP Committee with unanimous support, its path to becoming law is still long. The bill currently sits on the Senate calendar without a floor date and lacks a companion bill in the House of Representatives. Even if enacted, the full obligations of the law would not take effect until 2028 at the earliest, following an 18-month period for the Department of Health and Human Services (HHS), in consultation with the Federal Trade Commission (FTC), to write the necessary privacy, security, and breach-notification standards. If the bill does not pass by January 2027, it would need to be reintroduced in the next Congress. Stakeholders like the Center for Democracy and Technology have indicated a desire for further improvements to the bill. HHS would gain explicit authority and a deadline to regulate an industry it has not previously overseen, which could present challenges given its current backlog in finalizing other privacy rule updates.
Beyond the Headlines
The proposed Health Information Privacy Reform Act touches upon deeper implications regarding the evolving nature of personal data ownership and control in the digital era. It highlights the ethical dilemma of how personal health information, once generated by a consumer device, transitions between being a personal data point governed by a manufacturer's privacy policy and a protected health record under federal law. The bill's approach to creating 'regulated entities' signifies a shift towards a more comprehensive regulatory landscape for health data, moving beyond the traditional boundaries of healthcare providers. This could set a precedent for how other types of personal data collected by consumer technologies might be regulated in the future. The challenge lies in balancing innovation in health technology with robust privacy protections, ensuring that individuals can benefit from these advancements without compromising their fundamental right to privacy. The legislation also underscores the ongoing tension between federal and state privacy laws, as stricter state laws would continue to survive under the same preemption rules as HIPAA.
