Data Privacy,
Data Security,
Endpoint Security
Move Comes as Regulators Plan to Finalize Modifications to HIPAA Privacy Rule
Recently, an influential Senate committee voted to advance a significant piece of legislation designed to enhance privacy protections for health data that falls outside the scope of the Health Insurance Portability and Accountability Act (HIPAA). This development focuses particularly on data generated by consumer wearables, marking a pivotal step in modernizing health data management.
The approval of this bill arrives just as federal regulators prepare to finalize alterations to the existing HIPAA Privacy Rule, aiming to promote better coordination of care and improve patient access to their health information. The renewed efforts indicate a growing recognition of the nuances in current health data landscapes shaped by technology.
The Senate Health, Education, Labor and Pension (HELP) committee convened on Thursday, approving an amended version of the Health Information Privacy Reform Act. Introduced by committee chair, Senator Bill Cassidy, a Republican from Louisiana and one of the few physicians currently serving in Congress, the bill now moves forward to the complete Senate for further examination.
The committee vote was overwhelmingly in favor, with a 22-0 tally supporting the motion to advance the legislation. Among its key proposals, the amended bill mandates that the U.S. Department of Health and Human Services (HHS), in coordination with the Federal Trade Commission (FTC), draft protections akin to those established under HIPAA for health data not currently covered by the law.
This expanded protection would encompass a range of health technologies, including wellness apps and various platforms utilized by wearable devices. The proposed requirements encompass limitations on data usage and disclosure, enhanced individual rights, stringent data-security measures, and civil penalties that align closely with those established under HIPAA. Such measures indicate a comprehensive approach to health data regulation, reflecting the urgency and importance of privacy in the digital age.
Moreover, the bill instructs HHS to release guidance pertaining to the application of HIPAA’s “minimum necessary” standard for health data utilized in artificial intelligence and machine-learning initiatives, within one year following enactment. This suggestion underscores the increasing integration of AI in healthcare, further emphasizing the need for stringent protections against potential misuse.
Andrew Crawford, a privacy attorney at the Center for Democracy in Technology, commented on the bill’s significance, stating it represents a crucial extension of privacy protections to health data not maintained by traditional healthcare institutions. He highlighted that the legislation would ensure comprehensive safeguarding of individual health data, regardless of whether it is collected by healthcare providers, wearable device manufacturers, or AI systems. While acknowledging areas for improvement, Crawford noted that the bill promises substantial benefits for consumers and aims to curtail excessive health data collection practices.
In another significant move, the proposed legislation would mandate that organizations receiving health data through an individual’s HIPAA rights notify the patient when that information is no longer shielded by HIPAA protections, clarifying the conditions under which it can be disclosed. Additionally, the bill would require explicit consent from individuals prior to any sale of their health information to third-party entities, a crucial step towards enhancing personal autonomy over private data.
While the bill received swift bipartisan support during the committee’s review, questions remain regarding its acceptance by the full Senate and its subsequent journey through the House of Representatives to secure enactment into law. As the legislative calendar for 2026 is already brimming with various priorities, a congressional liaison shared that Cassidy is keen to prioritize and push through vital legislation before the conclusion of his term in January.
Concurrently, the 2026 regulatory agenda indicates that HHS’s Office for Civil Rights plans to issue a final rule this month aimed at reinforcing patients’ rights pertaining to their own protected health information (PHI). This initiative also strives to bolster data sharing for effective care coordination and enhance the involvement of family and caregivers during critical health events.
The anticipated modifications to the HIPAA Privacy Rule, initially published in January 2021 during President Donald Trump’s final weeks in office, had been stalled during the Biden administration. However, both Republican and Democratic administrations have shown a commitment to advancing policies that facilitate greater patient access to their health data, indicating a rare point of consensus across the political spectrum.
Mari Savickis, vice president of public policy at the College of Health Information Management Executives, pointed out that the proposed updates include prohibiting unreasonable identity verification demands imposed by covered organizations when individuals exercise their right of access under the Privacy Rule. This proactive measure is crucial in ensuring a smoother, more equitable process for patients seeking access to their health information.
Additionally, HHS is slated to propose regulations in November that would shorten the time frame for providers to respond to access requests for PHI from 30 days to just 15 days. Savickis suggested that there is potential for aligning access rights with rigorous identity standards to enhance overall security and privacy in health data management.
Ultimately, while the outlined timelines in HHS’s regulatory agenda appear ambitious, it is pertinent to note that federal agencies historically face challenges in adhering to their projected deadlines, often resulting in extensions or delays. This reflects a broader reality within governmental processes where significant reforms require sustained advocacy and engagement to come to fruition.