S. 3097 · On the floor · Commerce

Health Information Privacy Reform Act

What it does

Directs the Secretary of Health and Human Services, in consultation with the Federal Trade Commission, to promulgate regulations setting privacy, security, and breach notification standards for processing of applicable health information by regulated entities and their service providers.
Establishes privacy requirements including permitted and prohibited uses and disclosures of applicable health information, individual rights to access, amend, delete, and port health information, and designation of privacy officers by regulated entities.
Establishes security requirements based on well-established national frameworks such as National Institute of Standards and Technology cybersecurity performance goals for electronic applicable health information.
Establishes breach notification requirements substantially similar to existing Health Insurance Portability and Accountability Act breach notification requirements in the event of a breach of applicable health information.
Extends privacy and security practices under the Health Information Technology for Economic and Clinical Health Act to regulated entities and service providers with respect to applicable health information.

Aug 4, 2026: Placed on Senate Legislative Calendar under General Orders. Calendar No. 538.

Committee: Senate Health, Education, Labor, and Pensions