Requires companies that handle health information outside HIPAA to meet federal privacy, security, and breach notification standards, and gives individuals rights to access, correct, delete, and move their health data.

• Directs HHS, in consultation with the Federal Trade Commission, to issue privacy, security, and breach notification regulations for health information outside HIPAA within 18 months of enactment.
• Limits collection and retention of health information to what is reasonably necessary and bars sale or transfer to government entities except under a warrant, subpoena, or court order.
• Gives individuals rights to receive a privacy notice, access, amend, port, and delete their health information, with deletion required within 30 days of a request, and requires written authorization for any sale, licensing, transfer, or marketing.
• Sets national de-identification standards, prohibits re-identifying de-identified data, and directs HHS to issue guidance on the minimum necessary standard for training artificial intelligence models.

• Health, Education, Labor, and Pensions Committee (Senate)

Commerce