Sec. 2. Findings; rule of construction; sense of congress

813 words·~4 min read·/bill/117/s/3620/is/section-2·

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

Congress finds the following: The people of the United States are increasingly concerned about their civil liberties and the confidentiality, security, and use of their personal health information. Commercial entities are increasingly aware that consumers expect them to adopt privacy policies and take appropriate steps to protect consumers’ personal health information. Due to a lack of Federal guidelines and a range of different State and local rules regarding privacy protection for individually identifiable health information, there is a growing concern about the confidentiality of personal health information collected outside the context of health care delivery, payment, and the practice of medicine generally.

There is a need to ensure that accurate and timely health information flows to meet the needs of patients, reduce costs in the health care system, coordinate care, and improve health care outcomes. Access to accurate and complete health information is critical to ensure the equitable, safe, and effective delivery of care, the development of novel treatments and cures, the promotion of public health, and the refinement of health care delivery. During the public health emergency with respect to COVID–19 declared by the Secretary of Health and Human Services under section 319 of the Public Health Service Act ( 42 U.S.C. 247d ), some Federal and State privacy rules have been waived, modified, or not enforced to help contain the pandemic.

As a result, the COVID–19 contagion has uncovered areas where current State and Federal privacy rules may impede patient care, public health management, and efforts to control the pandemic. Moreover, the pandemic has spurred innovation including the development of new technologies and technology platforms that may not be covered by current regulatory constructs. Privacy regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 ( Public Law 104–191 ) have provided clearly defined responsibilities and enforcement for entities and business associates covered by such regulations, however, the regulations should be assessed to account for the evolution of emerging technologies, data and data management tools, and the modernization of health care delivery.

New rules and policies from the Federal Government encouraging the flow of health information to improve care and patient access to their own health information, including the rules promulgated under the 21st Century Cures Act ( Public Law 114–255 ), raise the issue of protected health information flowing to entities that are not subject to standardized privacy protections, including the privacy regulations promulgated under the Health Information Portability and Accountability Act of 1996 ( Public Law 104–191 ), the Health Information Technology for Economic and Clinical Health Act ( Public Law 111–5 ) (including the amendments made by such Act), and section 444 of the General Education Provisions Act ( 20 U.S.C. 1232g ; commonly known as the Family Educational Rights and Privacy Act of 1974 ).

Given the extensive proliferation of laws and proposals concerning the privacy of health information in light of recent changes in technology, applications, social media, and other platforms, and the increasing generation, collection, use, sharing, and selling of personal health information, a coordinated and comprehensive review is necessary to evaluate the effectiveness of existing protections of personal health information compiled by the health care, insurance, financial services, consumer electronics, advertising, technology, and other industries.

Use of the internet as a medium for commercial, social, and health related activities will continue to grow, and more data, including personal health information, will be generated, exchanged, and used by an increasing number of entities engaged in the digital marketplace. An increasing number of people of the United States are using consumer health technologies, including wearable technology, with about 20 percent of people of the United States reporting using such technology in 2020, and generating data about their personal health and well-being.

The United States is the leading economic and social force in the global information economy, and it is important for the United States to continue that leadership. As countries and governing bodies around the world continue to establish privacy standards, these standards will directly affect the United States. The shift from an industry-focused economy to an information-focused economy calls for a swift reassessment of the most effective ways to balance personal privacy against information use for legitimate purposes, keeping in mind the potential for unintended effects on technology and product development, innovation, and medical research.

This Act shall not be construed to prohibit the enactment of privacy legislation by Congress during the existence of the Commission on Health Data Use and Privacy Protection established under section 3. It is the sense of Congress that— it is the responsibility of Congress to act to protect the privacy of individuals, including individuals’ medical information, and to foster the improvement our Nation’s health care system; and further study by the Commission established under section 3 should not be considered a prerequisite for further consideration or enactment of health privacy or other related privacy legislation by Congress.

Connectionstraces to 3

Traces to 3 documents

U.S. Code

public-private-law