Senator Bill Cassidy (R-LA), the Ranking Member of the U.S. Senate Health, Education, Labor, and Pensions (“HELP”) Committee, published on February 21, 2024, a white paper with various proposals to update privacy protections for health data. In Part 1 of this blog series (see here), we discussed the first section of Senator Cassidy’s February 21, 2024, white paper. Specifically, we summarized Senator Cassidy’s proposals on how to update the existing framework of the Health Insurance Portability and Accountability Act, as amended, and its implementing regulations (collectively, “HIPAA”) without disrupting decades of case law and precedent. In this blog post, we discuss the other sections of the white paper, namely proposals to protect other sources of health data not currently covered by HIPAA.

Health Data in the HIPAA “Gray Area”

Senator Cassidy’s white paper explains that, while the existing HIPAA framework has functioned well, there are gaps between consumer/patient expectations and the actual protections. The white paper calls on Congress to legislate to address these “gray areas,” which include:

  • Genetic Data. The white paper discusses how genetic data collected by direct-to-consumer (“DTC”) companies is not subject to HIPAA and may be used beyond the original scope of the intended use when the sample was collected. The white paper proposes that DTC genetic testing companies be required to disclose to consumers that the data they collect is not subject to HIPAA and further proposes that Congress pass legislation to create “appropriate notice and consent requirements.” Senator Cassidy points to DTC genetic privacy laws enacted in several states that require patient consent for use of genetic data as examples of a potential legislative model. Further, Senator Cassidy calls on Congress to consider how to expand research protections for genetic data collected by DTC genetic testing companies, such as by implementing certain human subject research protections similar to those in the federal Common Rule.
  • Wellness and Wearables Data. The white paper calls on Congress to require developers of wellness applications to notify consumers that any information generated by the wellness app is not covered by the HIPAA framework to allow consumers to determine whether they are comfortable using that particular app. The white paper also highlights that data from wearable devices, such as smart watches and similar technologies, are generally not protected by HIPAA and may be purchased by employers to make inappropriate or discriminatory decisions related to hiring, firing, or benefits. The white paper instructs Congress to act to prevent discrimination of consumers based on collection of this identifiable wellness data, often incorrectly assumed by consumers to be protected by HIPAA.
  • Patient Notification Upon Removal of Health Data from HIPAA. Senator Cassidy states that software applications authorized through a patient’s right of access to download a patient’s medical record should be required to notify users when transferring health information regulated by HIPAA to an environment where HIPAA no longer applies. Senator Cassidy recommends that these software applications be required to provide plain-language notice regarding their collection and sharing of individuals’ data and seek express consent prior to selling or disclosing patient data to third parties.
  • Intake Services. The white paper compares intake information provided in a doctor’s office with similar information provided to a digital health company, noting that the former is covered by HIPAA, but the latter is not. The white paper calls this a “confusing inconsistency” not understood by patients and requests that Congress “provide greater clarity by ensuring HIPAA protections include intake information” to clarify that health data collected virtually receives the same level of protection as in-person treatment.

In this section, Senator Cassidy also acknowledges that the state comprehensive privacy laws do not consistently exempt HIPAA covered entities, which has led to challenges. While Senator Cassidy notes that states have a role in crafting their own regulations, he calls on Congress to consider a “federal floor” for health data in this “gray area,” similar to how HIPAA creates certain minimum requirements but does not preempt the field.

Senator Cassidy also discusses the FTC’s recent efforts to utilize its enforcement framework, including with the proposed updates to FTC’s Health Breach Notification Rule and recent enforcement actions (e.g., against GoodRx and Easy Healthcare). He notes that these efforts create uncertainty by requiring duplicative reporting and compliance with both FTC and OCR requirements. As such, he calls on Congress to consider how best to balance this enforcement framework while continuing to recognize OCR as the “primary enforcement body” over health data.

Data Outside of HIPAA

The third category of proposals centers around data generated outside of the health care setting that still has implications on individual health and privacy, such as geolocation data, internet searches, financial data, and biometric data. Senator Cassidy calls on Congress to pass a comprehensive data privacy law to regulate such data. For more details on the white paper, see our previous post.

Photo of Libbie Canter Libbie Canter

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports…

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports clients on their efforts to launch new products and services involving emerging technologies, and she has assisted dozens of clients with their efforts to prepare for and comply with federal and state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act.

Libbie represents clients across industries, but she also has deep expertise in advising clients in highly-regulated sectors, including financial services and digital health companies. She counsels these companies — and their technology and advertising partners — on how to address legacy regulatory issues and the cutting edge issues that have emerged with industry innovations and data collaborations.

As part of her practice, she also regularly represents clients in strategic transactions involving personal data and cybersecurity risk. She advises companies from all sectors on compliance with laws governing the handling of health-related data. Libbie is recognized as an Up and Coming lawyer in Chambers USA, Privacy & Data Security: Healthcare. Chambers USA notes, Libbie is “incredibly sharp and really thorough. She can do the nitty-gritty, in-the-weeds legal work incredibly well but she also can think of a bigger-picture business context and help to think through practical solutions.”

Photo of Anna D. Kraus Anna D. Kraus

Anna Durand Kraus advises on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (“HHS”) gives her broad experience with, and valuable insight into…

Anna Durand Kraus advises on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (“HHS”) gives her broad experience with, and valuable insight into, the programs and issues within the purview of HHS, including Medicare, Medicaid, fraud and abuse, and HIPAA privacy and security. Anna is co-chair of the firm’s Health Care Industry practice group.

Anna regularly advises clients on Medicare reimbursement matters, particularly those arising under Part B and the Part D prescription drug benefit. She also has extensive experience with the Medicaid Drug Rebate program. She assists numerous pharmaceutical and device manufacturers, health care providers, pharmacy benefit managers, and other health care industry stakeholders to navigate the challenges and opportunities presented by the Affordable Care Act.

Anna is a trusted adviser on health information privacy, security and breach notification issues, including those arising under the Health Insurance Portability and Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health (“HITECH”) Act. Her background in this area dates back to the issuance of the original HIPAA privacy regulations.

Anna’s clients depend on her to guide them through compliance with the Anti-Kickback statute, the Stark regulations, and other laws preventing fraud and abuse in the health care industry. Her deep knowledge of these laws has made her an important component of the firm’s representation of pharmaceutical companies and health care organizations under federal investigation or facing allegations under the False Claims Act. In addition, clients contemplating acquisitions in the health care sector rely on her to guide due diligence efforts.

Photo of Elizabeth Brim Elizabeth Brim

Elizabeth Brim is an associate in the firm’s Washington, DC office, where she is a member of the Data Privacy and Cybersecurity and Health Care Practice Groups and advises clients on a broad range of regulatory and compliance issues related to privacy and…

Elizabeth Brim is an associate in the firm’s Washington, DC office, where she is a member of the Data Privacy and Cybersecurity and Health Care Practice Groups and advises clients on a broad range of regulatory and compliance issues related to privacy and health care.

Elizabeth’s practice includes counseling clients on compliance with the complex web of health information privacy laws and regulations, such as HIPAA, the FTC’s Health Breach Notification Rule, and state medical and consumer health privacy laws as well as state consumer privacy and genetic privacy laws. She also advises clients on health care compliance issues, such as fraud and abuse, market access, and pricing and reimbursement activities.

Elizabeth routinely advises on regulatory compliance as part of transactions, clinical trial programs, collaborations and other activities that involve genetic data, and the development and operation of digital health products. As part of her practice, Elizabeth routinely counsels clients on drafting and negotiating privacy and health care terms with vendors and third parties and developing privacy notices and consent forms. In addition, Elizabeth maintains an active pro bono practice.

Elizabeth is an author of the American Health Law Association treatise, Pricing, Market Access, and Reimbursement Principles: Drugs, Biologicals and Medical Devices and the U.S. chapter of the Global Legal Insights treatise, Pricing & Reimbursement Laws and Regulations.

Photo of Natalie Maas Natalie Maas

Natalie is an associate in the firm’s San Francisco office, where she is a member of the Food, Drug, and Device, and Data Privacy and Cybersecurity Practice Groups. She advises pharmaceutical, biotechnology, medical device, and food companies on a broad range of regulatory…

Natalie is an associate in the firm’s San Francisco office, where she is a member of the Food, Drug, and Device, and Data Privacy and Cybersecurity Practice Groups. She advises pharmaceutical, biotechnology, medical device, and food companies on a broad range of regulatory and compliance issues.

Natalie also maintains an active pro bono practice, with a particular focus on health care and reproductive rights.