Congress expands health privacy rights beyond hospitals to data brokers and tech platforms
S. 3097 — Health Information Privacy Reform Act · Filed by Bill Cassidy (R-LA) · 1 cosponsor · Introduced Nov 4, 2025 · Reported out
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill extends HIPAA-like privacy protections to health information held by companies outside the traditional healthcare system—data brokers, tech platforms, and other entities that collect or process health data without being covered entities. It requires these regulated entities to obtain written consent before selling or sharing health information, give individuals rights to access, delete, and port their data, and comply with security and breach notification standards. It also tightens rules on de-identification and clarifies how the 'minimum necessary' standard applies to AI/machine learning training.
Why we flagged it
The bill's core mechanism is extending HIPAA-equivalent privacy protections to non-covered entities and data brokers. It is fundamentally a privacy-rights expansion, not a deregulation or carve-out, though it does create new compliance obligations for a broader class of entities.
What the text implies
- The bill's definition of 'applicable health information' is broad and includes geolocation data that 'could reasonably indicate an attempt to acquire a health service'—this may capture location tracking by mapping apps, fitness trackers, and other non-medical platforms, significantly expanding the scope of regulated entities beyond traditional data brokers.
- Section 2(c)(3) permits data collection for 'research subject to part 46 of title 45, Code of Federal Regulations'—this carve-out may allow broad secondary use of health data for AI/ML training and other research without explicit individual consent, potentially undermining the bill's core privacy promise.
The full analysis lists 5 implications of this text.
Who it affects
Ordinary citizens gain enforceable privacy rights over their health data held outside traditional healthcare (a major gap in current law), including deletion rights, portability, and explicit consent requirements for sales. The bill restricts data brokers and tech companies from monetizing health information without permission and blocks government access without legal process.