S. 3097 — Health Information Privacy Reform Act

This section directs the Secretary of Health and Human Services, in consultation with the Federal Trade Commission, to promulgate regulations establishing privacy, security, and breach notification standards for applicable health information processed by regulated entities and service providers. The standards must provide protections at least commensurate with HIPAA and HITECH Act rules for covered entities and business associates, including permitted uses and disclosures, individual rights to access and deletion, minimum necessary requirements, physical and technical safeguards based on NIST frameworks, and breach notifications. It applies HITECH Act privacy and security practices to these entities and authorizes civil penalties under existing regulations.

This section requires an individual's request to transmit protected health information to a designated third party to meet valid authorization standards. It permits covered entities and business associates to condition such transmission on advance payment of fees consistent with state law and acceptance of use terms. It limits fee applicability to direct access for the individual, personal representatives, involved persons, providers, or electronic transmission to patient portals or apps, and directs the Secretary of Health and Human Services to amend guidance within 180 days.

This section aligns confidentiality protections for records of substance use disorder treatment, prevention, or research with the HIPAA regulations, permitting disclosures for treatment, payment, and health care operations as allowed under those rules rather than under the prior statutory consent and method provisions. It retains limited disclosures without consent for medical emergencies, scientific research or audits, and court orders showing good cause.

This section directs the Secretary of Health and Human Services to contract with the National Academies of Sciences, Engineering, and Medicine within 60 days of enactment to study the risks and benefits of compensating patients for sharing identifiable health data for research. The study must examine privacy risks from integrating identifiable, de-identified, and aggregated data; privacy-enhancing tools; consent tracking feasibility; ethical considerations for compensation; whether de-identified data exemptions should account for patient opt-in or opt-out opportunities; and re-identification risks.

This section requires any regulated entity or service provider accessing protected health information through the patient right of access to provide written plain-language notice beforehand that the information will lose HIPAA privacy protections and to explain potential redisclosures, and to obtain individual consent before selling the information to third parties. It also requires advance written notice and an opt-out opportunity for users of digital technology that generates wellness data, such as vital statistics or step counts, which is not subject to HIPAA protections, effective one year after enactment.

This section requires the Secretary of Health and Human Services to publish guidance within one year of enactment on applying the minimum necessary standard to data used for artificial intelligence and machine learning applications. The guidance must address health data interoperability requirements and the use of limited data sets.

This section directs the Secretary of Health and Human Services to issue regulations within one year establishing unified national standards for rendering applicable health information as de-identified information. The standards must meet or exceed the de-identification requirements in 45 CFR 164.514(b), specify the use of privacy-enhancing technologies, and require contractual agreements prohibiting re-identification when such information is shared with another person or entity.

This section applies the preemption rules in 45 CFR 160.203 to the requirements of this Act in the same manner and to the same extent as those rules apply to HIPAA standards, requirements, and implementation specifications under 45 CFR subchapter C.