On April 7, 2024, House Committee on Energy and Commerce Chair Cathy McMorris Rodgers (R-WA-5) and Senate Committee on Commerce, Science and Transportation Chair Maria Cantwell (D-WA) released a discussion draft of federal privacy legislation, entitled the American Privacy Rights Act. According to the press release, the bill “sets clear, national data privacy rights and protections for Americans, eliminates the existing patchwork of state comprehensive data privacy laws, and establishes robust enforcement mechanisms to hold violators accountable, including a private right of action for individuals.” Specifically, the bill includes definitions for health-related data and information to improve future health technology regulations and sets privacy requirements for business associates that partner with health care entities. The bill does not preempt or displace state laws or regulations for the protection of health information, medical records, or status of HIV testing. Notably, the bill authorizes the Federal Trade Commission (FTC) to enforce the bill’s privacy requirements, including the health care provisions. Recent congressional hearings on the impact of artificial intelligence (AI) on patient data and privacy as well as the recent Change Healthcare disruption have added to the debate about whether sufficient safeguards are in place to protect individual health data. Federal agencies are also signaling that additional federal rulemaking may be considered.

The discussion draft is available here.

The press release is available here.

The section-by-section analysis is available here. 

Impact on General Dentistry: Health care data security and privacy are an increasing focal point in Congress, especially in the wake of the Change Healthcare cyberattack. This legislation would touch virtually all aspects of health care, including medical records and health information privacy. AGD will continue to update members as the bill progresses in Congress.