Patient notification requirements under the HIPAA privacy regulations

(a) Patient notification upon removal Any regulated entity or service provider who gains access to the protected health information of an individual through the patient right of access under section 164.524 of title 45, Code of Federal Regulations (or any successor regulations) shall— (1) provide a written plain language notification to such individual prior to accessing such information— (A) that such protected health information will no longer be subject to the protections under the HIPAA privacy regulation; and (B) that includes an explanation of how and to which entities such protected health information may be redisclosed; and (2) require the consent of the individual before selling such protected health information to third parties. (b) Patient notification regarding wellness data (1) In general Any regulated entity or service provider who offers digital technology that generates wellness data about individuals shall, with respect to each individual who uses such technology— (A) provide a written plain language notification to the individual in advance of initiating the generation of such data that such data will not be subject to the protections of the HIPAA privacy regulation; and (B) offer the individual an opportunity to opt out of such wellness data generation. (2) Wellness data In this subsection, the term wellness data means data generated for the purpose of promoting health or preventing disease, which may include vital statistics, step counts, and medical regimen compliance. (c) Definitions In this section— (1) the terms business associate, covered entity, and protected health information have the meanings given such terms in section 160.103 of title 45, Code of Federal Regulations (or any successor regulations); (2) the term HIPAA privacy regulation has the meaning given such term in section 1180(b)(3) of the Social Security Act (42 U.S.C. 1320d–9(b)(3)); and (3) the terms regulated entity and service provider have the meanings given such terms in section 2. (d) Effective date This section shall take effect beginning one year after the date of enactment of this Act.

(a) Patient notification upon removal Any regulated entity or service provider who gains access to the protected health information of an individual through the patient right of access under section 164.524 of title 45, Code of Federal Regulations (or any successor regulations) shall— (1) provide a written plain language notification to such individual prior to accessing such information— (A) that such protected health information will no longer be subject to the protections under the HIPAA privacy regulation; and (B) that includes an explanation of how and to which entities such protected health information may be redisclosed; and (2) require the consent of the individual before selling such protected health information to third parties. (b) Patient notification regarding wellness data (1) In general Any regulated entity or service provider who offers digital technology that generates wellness data about individuals shall, with respect to each individual who uses such technology— (A) provide a written plain language notification to the individual in advance of initiating the generation of such data that such data will not be subject to the protections of the HIPAA privacy regulation; and (B) offer the individual an opportunity to opt out of such wellness data generation. (2) Wellness data In this subsection, the term wellness data means data generated for the purpose of promoting health or preventing disease, which may include vital statistics, step counts, and medical regimen compliance. (c) Definitions In this section— (1) the terms business associate, covered entity, and protected health information have the meanings given such terms in section 160.103 of title 45, Code of Federal Regulations (or any successor regulations); (2) the term HIPAA privacy regulation has the meaning given such term in section 1180(b)(3) of the Social Security Act (42 U.S.C. 1320d–9(b)(3)); and (3) the terms regulated entity and service provider have the meanings given such terms in section 2. (d) Effective date This section shall take effect beginning one year after the date of enactment of this Act.