Politicians on both sides of the aisle agree that more safeguards are needed for Americans’ health data and the ways it’s used. The urgency level has risen as data collection online has grown, states have begun enforcing abortion bans and cyberattacks have increased. However, lawmakers, lobbyists and the Biden administration have a multitude of views on how to protect health data, particularly data that’s not currently covered by the federal health privacy law, HIPAA. Legislation is coming: “There’s gonna be an explosion in the new Congress,” René Quashie, VP of digital health at the Consumer Technology Association, a trade group representing major tech companies, told Ruth. What is and isn’t covered by HIPAA? The 1996 law says covered entities — health care providers, insurers and data clearinghouses — must protect health data. But data collected by health apps, which track everything from weight loss to pregnancy, isn’t. Neither are web searches for symptoms, illnesses or treatments. Data amassed by Fitbits and Apple Watches is also unprotected, meaning it can be sold or shared without a user’s consent. Abortion decision fallout: The overturning of Roe v. Wade by the Supreme Court is motivating abortion-rights advocates to press for new data protections. In at least one case, law enforcement used online chat logs in an investigation of an allegedly illegal abortion. Additionally, geolocation could potentially be used to prosecute women who’ve obtained an abortion in states where the procedure is illegal. Data freedom’s risks: As of October 2022, an HHS rule that Congress ordered in a 2016 law requires doctors to make digital medical records accessible to patients. That should help patients as they shop around for medical care, but it also opens a data-protection gap. Once patients download their data, it’s no longer covered by HIPAA. Several data protection bills could get a second look in the new Congress: — The Health Data Use and Privacy Commission Act , sponsored by Sen. Bill Cassidy (R-La.), aims to establish a blue-ribbon panel to recommend changes to health privacy laws. Cassidy is pressing to get his bill included in year-end legislation. — The My Body, My Data Act , sponsored by Rep. Sara Jacobs (D-Calif.), creates protections for sexual and reproductive health data online. — The Data Care Act from Sen. Brian Schatz , (D-Hawaii) would bar companies from using consumer data in a way that could cause foreseeable harm. — The American Data Privacy and Protection Act would set federal privacy rights, with heightened protections for kids, and has the backing of Frank Pallone (D-N.J.), the House Energy and Commerce Committee chair, and Cathy McMorris Rodgers (R-Wash.), the panel’s ranking member and likely chair if Republicans take control of the House. Executive action: President Joe Biden has directed the Department of Health and Human Services to issue new guidance for protecting health data as well as information on how consumers can protect their own data. He’s also asked the Federal Trade Commission to consider taking steps to protect data for people seeking abortions. Biden has also issued a proposed AI Bill of Rights , which advocates building artificial intelligence with data privacy in mind. Developers should minimize data collection and get consent for any data collected, it says. Outside interests: Lobbying groups are ensuring that lawmakers know where they stand. OCHIN, a nonprofit focused on equitable distribution of innovation in health care, thinks Congress should extend HIPAA to cover health data collected online and by apps. By contrast, the Consumer Technology Association, which represents major companies like Google and Amazon, would like Congress to start fresh with national privacy rules designed for the ways data is used now.
| 
