A Republican bill with 1 Democratic cosponsor · See the cosponsor
Last activity — Placed on Senate Legislative Calendar under General Orders. Calendar No. 538.
Cleared committee, waiting for its first floor vote
A committee approved it and it is on the calendar of the chamber it started in.
This is further than most bills get, and still no promise of a vote: the calendar is a queue, and the majority leadership decides what is called. A bill can sit here until the Congress ends.
Its path through Congress
- Introduced
- On Calendar
What this bill would do
S. 3097 is known as the Health Information Privacy Reform Act. This bill directs the Secretary of Health and Human Services, along with the Federal Trade Commission, to set new privacy, security, and breach notification standards for health information. It places limits on how regulated entities and service providers can collect, use, retain, and transfer applicable health information. The bill also establishes rules for patient access to electronic health records, including rules around fees and third-party transmission. Additionally, it requires the creation of unified national standards for de-identifying health information and prohibits the re-identification of such data. Finally, the legislation sets specific regulations regarding minimum necessary data standards for artificial intelligence and machine learning models.
Yes· 3 of 14
- Scored +9
Does this protect people from being watched or searched?
By introducing comprehensive privacy regulations, data minimization requirements, and re-identification bans, the bill robustly protects personal health information rights.
- Scored +8
Does this give people more control over their personal data?
The bill significantly strengthens privacy protections by setting unified national de-identification standards, banning re-identification, and limiting data retention.
- Scored +7
Does this give people more protection from unfair business practices?
The bill establishes strict privacy, security, and breach notification standards for health information outside traditional HIPAA coverage, enhancing consumer data protections.
The opposite
- Scored -2
Would business owners be better off under this?
Regulated entities and data brokers face stringent compliance obligations, data minimization rules, and civil penalties.
Who it would affect, and how
Potential Positive Impacts for People
-
Strengthened Privacy Protections: Under Section 2, the bill requires new privacy, security, and breach notification standards for applicable health information. This gives individuals better safeguards for their personal health data outside of traditional HIPAA coverages.
-
Data Minimization and Retention Limits: Under Section 2(b), regulated entities and service providers are restricted from collecting, processing, or transferring health information beyond what is permitted, and they cannot keep the information longer than reasonably necessary. This protects people from having their health data hoarded indefinitely by companies.
-
Ban on Re-identification: Under Section 5(c), recipients of de-identified health information are explicitly prohibited from re-identifying or attempting to re-identify the information. This protects individuals from having their anonymized health data tracked back to their personal identities.
Potential Negative Impacts for People
-
Advance Fees for Health Records: Under Section 3(a), covered entities or business associates may condition the transmittal, production, or provision of an individual's electronic health record to a designated person upon paying fees in advance. This could create a financial hurdle for individuals trying to share their medical information with third parties of their choice.
-
Binding Terms and Conditions: Under Section 3(a)(2)(B), when an individual asks to send their health records to a designated person, that recipient must acknowledge and accept terms and conditions of use as a legally binding obligation. This adds bureaucratic hurdles and legal red tape for people simply trying to move their own health data.
Groups and Interests Ranking
Every group the model scored this bill for, from -10 to +10. Tap or hover a score for the reason it gave.
- Demographic And Interest Groups
- Would children be better off under this? — Enhanced health data privacy standards protect the sensitive health information of individuals of all ages, including children. Would people in middle age be better off under this? — Middle-aged individuals receive stronger safeguards against the indefinite retention and unauthorized sharing of personal health records. Would people over 65 be better off under this? — Seniors benefit from robust privacy protections and clearer rules governing the secure management of their electronic health records. Would people in their twenties and thirties be better off under this? — Young adults benefit from expanded privacy protections covering digital wellness data and health information outside traditional HIPAA guidelines. Would middle-income households be better off under this? — Provides substantial data privacy protections to average consumers against unregulated health data tracking and monetization. Would women be better off under this? — Protections regarding precise geolocation data and health information help safeguard sensitive reproductive and general healthcare data. Would households on low incomes be better off under this? — While general privacy is improved, the provision allowing advance fees for electronic health record transmittals may create minor financial hurdles. Would business owners be better off under this? — Regulated entities and data brokers face stringent compliance obligations, data minimization rules, and civil penalties.
- Education And Technology
- Does this give people more control over their personal data? — The bill significantly strengthens privacy protections by setting unified national de-identification standards, banning re-identification, and limiting data retention. Does this put more rules on large technology companies? — The legislation places strict limits on regulated entities and service providers regarding the collection, retention, and transfer of health data.
- Governance And Ideology
- Does this protect people from being watched or searched? — By introducing comprehensive privacy regulations, data minimization requirements, and re-identification bans, the bill robustly protects personal health information rights. Does this give the federal government more power? — The bill expands federal regulatory oversight through HHS and the FTC to establish national standards for applicable health information.
- Economy And Finance
- Does this give people more protection from unfair business practices? — The bill establishes strict privacy, security, and breach notification standards for health information outside traditional HIPAA coverage, enhancing consumer data protections.
- National Security And Foreign Policy
- Does this better protect the country from computer attacks? — The bill mandates security requirements based on established national frameworks like NIST to safeguard electronic health information.
- Healthcare
- Does this make health care easier to get in general? — The legislation clarifies rules around electronic health record access and portability for patients, while allowing entities to charge advance fees under certain conditions.
- 8/5/2026
- 1 Cosponsor added.
- 8/4/2026
- Committee on Health, Education, Labor, and Pensions. Reported by Senator Cassidy with an amendment in the nature of a substitute. Without written report.
- Placed on Senate Legislative Calendar under General Orders. Calendar No. 538.
- 7/30/2026
- Committee on Health, Education, Labor, and Pensions. Ordered to be reported with an amendment in the nature of a substitute favorably.
- 11/4/2025
- Read twice and referred to the Committee on Health, Education, Labor, and Pensions.
- Introduced in Senate
Maggie HassanDemocrat · New Hampshire