Congress expands health privacy rights beyond hospitals to data brokers and tech platforms

What it does

This bill extends HIPAA-like privacy protections to health information held by companies outside the traditional healthcare system—data brokers, tech platforms, and other entities that collect or process health data without being covered entities. It requires these regulated entities to obtain written consent before selling or sharing health information, give individuals rights to access, delete, and port their data, and comply with security and breach notification standards. It also tightens rules on de-identification and clarifies how the 'minimum necessary' standard applies to AI/machine learning training.

Why we flagged it

The bill's core mechanism is extending HIPAA-equivalent privacy protections to non-covered entities and data brokers. It is fundamentally a privacy-rights expansion, not a deregulation or carve-out, though it does create new compliance obligations for a broader class of entities.

What the text implies

• The bill's definition of 'applicable health information' is broad and includes geolocation data that 'could reasonably indicate an attempt to acquire a health service'—this may capture location tracking by mapping apps, fitness trackers, and other non-medical platforms, significantly expanding the scope of regulated entities beyond traditional data brokers.
• Section 2(c)(3) permits data collection for 'research subject to part 46 of title 45, Code of Federal Regulations'—this carve-out may allow broad secondary use of health data for AI/ML training and other research without explicit individual consent, potentially undermining the bill's core privacy promise.
• The bill requires HHS to issue guidance on 'minimum necessary' for AI/ML training within 1 year, but does not define what constitutes 'reasonably necessary' for model development—this ambiguity may permit large-scale data collection for AI training under the guise of research exemptions.
• De-identification standards are tightened (expert determination only, not safe harbor), but the bill permits de-identified data to be shared if recipients contractually agree not to re-identify—enforcement of such contracts depends on private litigation and FTC action, not direct regulatory oversight.
• The bill does not explicitly address secondary sales of de-identified data or data that has been aggregated/anonymized by intermediaries, potentially creating loopholes for data brokers to monetize health information through indirect channels.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

Ordinary citizens gain enforceable privacy rights over their health data held outside traditional healthcare (a major gap in current law), including deletion rights, portability, and explicit consent requirements for sales. The bill restricts data brokers and tech companies from monetizing health information without permission and blocks government access without legal process. However, the bill permits broad exceptions for research, public health, and fraud prevention, and relies on regulatory

Named in the bill

HHS (Department of Health and Human Services), Federal Trade Commission (FTC), Data brokers, Tech platforms and regulated entities, Covered entities and business associates (HIPAA), FDA (Food and Drug Administration), National Coordinator for Health Information Technology

Where it stands

1 cosponsor: 1 Democrats.

• Nov 4, 2025 — Introduced · Congress.gov: “Introduced in Senate”
• Nov 4, 2025 — Referred to Senate Committee on Health, Education, Labor, and Pensions · Congress.gov: “Read twice and referred to the Committee on Health, Education, Labor, and Pensions”
• Jul 30, 2026 — Reported out of committee · Congress.gov: “Committee on Health, Education, Labor, and Pensions. Ordered to be reported with an amendment in the nature…”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

7 lobbying clients named this bill on 10 disclosure filings across 2 quarters, Dec 2025 to Jun 2026. Those filings disclosed $660,000 in lobbying spend. A filing names 1 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 86% of bills with at least one filing.

Bill Cassidy, the sponsor, reported $1,329,254 in PAC receipts in the 2026 cycle. $2,000 of that came from 1 PAC tied to these lobbying clients.

• Healthcare Leadership Council — $200,000 on 1 filing
• The Sequoia Project — $120,000 on 2 filings
• Alliance for Health Information Operations and Standards — $100,000 on 2 filings
• Leidos Holdings, Inc. — $80,000 on 2 filings
• Mro Corp. — $60,000 on 1 filing

Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.