Health Information Privacy Reform Act

This bill expands federal privacy, security, and breach notification protections to health information held by entities not currently covered by the Health Insurance Portability and Accountability Act (HIPAA), such as data brokers and health apps. It also updates rules for accessing electronic health records, sets new standards for de-identified data, and clarifies the minimum necessary standard for health information used in artificial intelligence.

Sec. 2, Protections for applicable health information: The Secretary of Health and Human Services, with the Federal Trade Commission, must issue regulations within 18 months for privacy, security, and breach notification for applicable health information processed by regulated entities and service providers. These regulations must include individual rights (notice, access, amendment, deletion, portability), data minimization, retention limits, and breach notification. Enforcement is coordinated between the two agencies, with civil penalties under existing HIPAA enforcement rules. Government access to such information is prohibited unless compelled by legal process.

Sec. 3, Rights and requirements regarding access to certain protected health information: When an individual requests that a covered entity or business associate send their electronic protected health information to a third party, the entity may condition that transmission on the third party paying fees allowed by state law and accepting the individual's terms of use. Fees under current rules apply only when information is sent to the individual, their provider, or a personal health record they control.

Sec. 4, Minimum necessary guidance: Within one year, the Secretary must issue regulations on the minimum necessary standard for applicable and protected health information, including its use to train artificial intelligence or machine learning models. The regulations must clarify that the standard does not allow denying a required disclosure as technically infeasible, specify how it applies to AI training, and address interoperability requirements.

Sec. 5, De-identified information: Within one year, the Secretary must set unified national standards for de-identifying applicable health information. These standards must be at least as protective as the expert determination method, may not rely solely on the safe harbor method, require contractual promises not to re-identify, and account for evolving re-identification methods including AI. Recipients of de-identified information are prohibited from re-identifying it, with violations subject to civil penalties.

Sec. 6, Preemption: The existing HIPAA preemption rule applies to the requirements of this Act in the same way it applies to HIPAA standards.