PRIA Logo™
119-s-3097119th CongressWALLET

Health Information Privacy Reform Act

Sponsored By: Senator Cassidy, Bill [R-LA]

In Committee

Summary

National privacy rules for health information set a federal floor for how companies and service providers can use, secure, and share health data. The bill centers on individual rights, data minimization, and strong de-identification and anti–reidentification rules.

Show full summary
  • Patients and families gain clearer rights. Individuals get access to their applicable health information, can direct electronic health records to third parties, request amendments, request deletion that must be honored within 30 days, and obtain portability between apps and services. The law also limits uses that would investigate or penalize people for seeking care and restricts certain government access to this data.
  • Health organizations and service providers face new operational rules. HHS must write privacy, security, and breach-notification regulations within 18 months that align with HIPAA and HITECH standards. Covered entities must adopt safeguards like a privacy officer, training, documented policies, and face civil penalties for violations.
  • Researchers and tech firms get new de-identification and reidentification limits. HHS must set unified de-identification standards within 1 year that permit privacy-enhancing technologies. Contracts must bar recipients from re-identifying data and require downstream parties to follow the same rules.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

3 provisions identified: 2 benefits, 0 costs, 1 mixed.

New national rules for de-identified data

If enacted, HHS would set national rules within one year for when health data is truly de-identified. The rules would require written contracts that ban any recipient or downstream recipient from trying to re-identify the data. De-identification rules would have to be at least as protective as the HIPAA expert-determination method and would address AI re-identification risks. Violations of the re-identification ban would be subject to civil penalties.

Stronger health privacy and data rights

If enacted, the HHS Secretary would write privacy, security, and breach-notification rules within 18 months for a broader set of health data holders. You would get rights to notice, access (including directing electronic transfers), amend, delete (requests fulfilled within 30 days), and move your health data. The rules would limit how much health data companies may collect and how long they can keep it, require privacy officers and workforce training, and apply HIPAA-like security and breach rules. HHS would also clarify how the "minimum necessary" rule applies to AI and require those rules be reviewed at least every three years.

Fees for electronic health record transfers

If enacted, a provider or service provider would be able to require the person you designate to receive your electronic health record to pay fees in advance and accept binding terms. Those fees must follow applicable State law and certain federal fee rules would still apply for records given to you, your provider, or your personal health record. The bill would not allow fees or terms that deny, delay, or condition transfers in a way that counts as information blocking. The Secretary must update guidance within 180 days.

Sponsors & CoSponsors

Sponsor

Cassidy, Bill [R-LA]

LA • R

Cosponsors

  • Sen. Hassan, Margaret Wood [D-NH]

    NH • D

    Sponsored 8/5/2026

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation