On February 9, 2022, U.S. Sens. Tammy Baldwin (D-Wis.) and Bill Cassidy (R-La.) introduced the “Health Data Use and Privacy Commission Act.” The bipartisan act, intended to modernize the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and account for emerging health care technologies, would establish a new commission to recommend health information privacy law revisions to Congress. The commission would opine on:

• Potential threats posed to individual health privacy;
• Appropriate time, benefits, and consequences to sharing health information;
• Effectiveness of existing health privacy statutes;
• Recommendations on necessary federal regulations;
• Analysis of financial needs for additional regulations;
• Cost analysis of legislative or regulatory changes;
• Recommendations on non-legislative health privacy solutions; and
• Reviewing the effectiveness and utility of third-party statements of privacy principles and private sector self-regulatory efforts.

This modernization could mean not only changes for existing covered entities and business associates, but appears specifically targeted at expanding HIPAA’s reach to entities, such as health technology and app providers, that have thus far generally exceeded HIPAA’s reach. Health technology and app providers not currently complying with HIPAA may face significant changes.

The act has been referred to the U.S. Senate Committee on Health, Education, Labor, and Pensions. We will continue monitoring its development.