By modernizing health privacy law, this bill addresses gaps left by HIPAA that leave health data from apps, wearables, and consumer platforms unprotected. Protecting this data can help reduce discrimination and unauthorized commercial exploitation, issues that disproportionately affect vulnerable groups such as those with low digital literacy. Strengthened privacy may improve trust and encourage equitable access to digital health tools.
A proposed or enacted law passed by a legislative body (e.g., Congress). It includes bills (proposed laws) and statutes (laws that have been passed and signed into effect).
Who It Impacts: Everyone within the jurisdiction of the law. Legislation passed by Congress and signed into law applies to individuals, businesses, federal and state agencies, and sometimes even foreign entities if the law has international implications.
Who Is Not Impacted: Those outside the scope of the law. For example, a law regulating U.S. healthcare providers does not impact people in other countries. Some laws may also include exemptions for certain groups (e.g., small businesses, religious organizations).
Date Enacted
November 4, 2025
Last Updated
December 16, 2025
Policy Type
Public Health
Research and Data
No items found.
Summary
Summary (50 Words or fewer): This bill would expand federal privacy protections for health-related data beyond current HIPAA coverage to include consumer health technologies (wearables, apps, trackers) and other non-HIPAA systems, requiring disclosure of data use and informed consent before collection, use, or sharing of sensitive health information.
Impact Analysis
Legal Challenges
N/A
Take Institutional Action
Review internal practices for collecting, storing, and sharing digital health data (including data from patient portals and integrated devices) to prepare for potential expanded federal standards. Strengthen consent processes so individuals clearly understand how their health data (including digital and wearable data) may be used and shared.
Implement administrative, technical, and physical safeguards aligned with anticipated federal privacy standards, especially for entities handling cross-platform health data. Consider informing patients about their privacy rights and how digital health tools interact with federal privacy protections.
Associated or Derivative Policies
Builds on the Health Insurance Portability and Accountability Act (HIPAA) of 1996, which currently protects only certain health data, and seeks to extend similar protections to non-HIPAA health information.
Policy Prior to 2025
Before this bill, HIPAA and the HITECH Act provided strong protections for health data handled by “covered entities” (providers, insurers) and their business associates, but health information outside these settings, including data from fitness apps, wearables, and direct-to-consumer health platforms, often lacked robust federal protections.
Additional Resources
National Library of Medicine, Principles for Health Information Collection, Sharing and Use: https://pmc.ncbi.nlm.nih.gov/articles/PMC10912036/
CDC: Data Sharing and Collection Principles and Standards: https://www.cdc.gov/program-collaboration-service-integration/php/data-security/principles.html
.png)
