Bill Summary – FastDemocracy

GOVERNMENT OF THE DISTRICT OF COLUMBIA

                             OFFICE OF THE ATTORNEY GENERAL

ATTORNEY GENERAL

BRIAN L. SCHWALB

July 12, 2024

The Honorable Phil Mendelson

Chairman, Council of the District of Columbia

John A. Wilson Building

Pennsylvania Avenue, N.W.

Washington, D.C. 20004

Dear Chairman Mendelson:

I write to transmit the “Consumer Health Information Privacy Protection (CHIPPA) Act of 2024,” for

consideration and enactment by the Council of the District of Columbia.

Personal health data that is uploaded to online platforms like company websites, search engines, apps, and

even social media is being collected, shared, and sold to third parties without the consumer’s consent or

knowledge. While most people believe that the federal Health Insurance Portability and Accountability

Act of 1996 (“HIPAA”) protects all personal health data from being shared without consent or knowledge,

it only applies to data collected by a “covered entity,” such as health insurers, hospitals, and healthcare

providers. It does not extend to personal health information shared by non-covered entities. For example,

health devices, apps, Apple Watch, and patient support groups fall outside of HIPAA regulation.

This legislation will ensure regulated entities that obtain, collect, share, and sell consumer personal health

data are responsible, transparent, and held accountable to the consumer. CHIPPA will do the following:

Require regulated entities to establish and make publicly available a consumer health data privacy

      policy governing the collection, use, sharing, and sale of consumer health data.

Require that regulated entities obtain the consumer’s informed consent before collecting and

      sharing their personal health data.

Establish a consumer’s right to access and choose whether and how their personal health data is

      used by a regulated entity.

Establish additional protections and consumer authorizations for the sale of personal health data.

Require regulated entities to only collect health data that is necessary for the purposes disclosed to

      the consumers and to only use, share, and retain the consumer health data for that purpose.

Prohibit the establishment of geofences around places where health services are delivered under

      specified circumstances.

Make violations unfair and deceptive trade practices.

I ask that the Council enact this legislation to ensure that everyone, regardless of whether they are a patient

seeking health care services, a consumer signing-up for a fitness app, or purchasing an item online, knows

why, how, and to whom their personal health data is being used, shared, and sold. If you have any

             400 Sixth Street, N.W., Washington, DC 20001, (202) 727-3400, Fax (202) 730-0484

questions, please contact me or Deputy Attorney General for Policy and Legislative Affairs Candyce

Phoenix at (202) 788-2066 or Candyce.Phoenix@dc.gov.

Sincerely,

Brian L. Schwalb

Attorney General for the District of Columbia

                                                2

 2

                                                         ~

                                                              :Iiz      ~//4----

                                                                        n Phil Mendelson

                                                          at the request of the Attorney General

 5

 6

 7

                                                    A BILL

 9

IO

11

                         IN THE COUNCIL OF THE DISTRICT OF COLUMBIA

13

14

15

16

 To require regulated entities that collect consumer health data to have a consumer health data

        privacy policy containing specific information about its collection, use and sharing of

        consumer health data and post it on the home page of their website, to prohibit regulated

        entities from contracting with processors, affiliates, or third parties to process consumer

        health data in a manner inconsistent with the policy, to require regulated entities to obtain

        consumer consent before collecting consumer health data after providing the consumer

        with requests for consent containing specified information, to limit a regulated entity's

        collection and sharing of consumer health data to the purposes contained in the

        consumer's consent, to establish a consumer's right to obtain information about consumer

        health infonnation collected and shared, to withdraw consent for collection and sharing,

        and to obtain deletion of info1mation collected and shared, to require a valid consumer

        authorization before consumer health data may be sold, to prohibit the establishment of

        geofences around places where health services are delivered under specified

        circumstances, to make violations of this act unfair and deceptive trade practices, and to

3I          exclude certain types of data collection and data sharing from the operation of the act.

32

          BE IT ENACTED BY THE COUNCIL OF THE DISTRICT OF COLUMBIA, That this

 act may be cited as the "Consumer Health Information Privacy Protection (CHIPP A) Act of

 2024".

          Sec. 2. Definitions

37

          For the purposes of this act, the term:

39

          ( 1)   "Abortion" means the termination of a pregnancy for purposes other than producing a

 live birth.

        (2) “Affiliate” means a legal entity that shares common branding with another legal entity

 and controls, is controlled by, or is under common control with another legal entity. For purposes

 of this definition, “control” or “controlled” means:

                (A) Ownership of, or the power to vote, more than 50 percent of the outstanding

 shares of any class of voting security of a company;

                (B) Control in any manner over the election of a majority of the directors or of

 individuals exercising similar functions; or

                (C) The power to exercise controlling influence over the management of a

 company.

        (3) “Authenticate” means to use reasonable means to determine that a request to exercise

 any of the rights afforded in this act is being made by, or on behalf of, the consumer who is

 entitled to exercise such consumer rights with respect to the consumer health data at issue.

        (4) “Biometric data” means data that is generated from the measurement or technological

 processing of an individual’s physiological, biological, or behavioral characteristics and that

 identifies a consumer, whether individually or in combination with other data. Biometric data

 includes:

                (A) Imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and

 voice recordings, from which an identifier template can be extracted; and

                (B) Keystroke patterns or rhythms and gait patterns or rhythms that contain

 identifying information.

        (5) “Clear and conspicuous” means a disclosure that is easily noticeable and easily

 understandable by the consumer and does not contain any statements that are inconsistent with,

 or in mitigation of any other statements or disclosures provided by the regulated entity.

                                                      2

        “Clear and conspicuous” requires the information to be reasonably accessible to

 consumers with disabilities, taking into account industry standards for online disclosures.

        (6) “Collect” means to buy, rent, access, retain, receive, acquire, infer, derive, or

 otherwise process consumer health data in any manner.

        (7) “Consent” means a clear affirmative act that signifies a consumer’s freely given,

 specific, informed, opt-in, voluntary, and unambiguous agreement, following a clear and

 conspicuous disclosure to the individual, which shall consist of written consent or consent

 provided by electronic means. For the purposes of this act “consent” shall not include:

                (A) A consumer’s acceptance of a general or broad terms-of-use agreement or a

 similar document that contains descriptions of personal data processing along with other

 unrelated information;

                (B) A consumer’s hovering over, muting, pausing, or closing a given piece of

 electronic content; or

                (C) A consumer’s agreement obtained through the use of deceptive designs.

        (8) “Consumer” means a natural person acting in an individual or household capacity,

 however identified, including by any unique identifier, who is a District of Columbia (“District”)

 resident or whose consumer health data is collected in the District. “Consumer” does not include

 an individual acting in the course of their employment.

        (9) “Consumer health data” means personal information that is linked or can reasonably

 be linked to a consumer and that identifies the consumer’s past, present, or future physical or

 mental health status. “Consumer health data” does not include personal information that is used

 to engage in public or peer-reviewed scientific, historical, or statistical research in the public

 interest that adheres to all other applicable ethics and privacy laws and is approved, monitored,

                                                       3

 and governed by an institutional review board, human subjects research ethics review board, or a

 similar independent oversight entity that determines that the regulated entity or the small

 business has implemented reasonable safeguards to mitigate privacy risks associated with

 research, including any risks associated with reidentification.

        (10) “Deceptive design” means a user interface designed or manipulated with the effect

 of subverting or impairing user autonomy, decision making, or choice. “Any practice that the

 Federal Trade Commission refers to as a “dark pattern” is presumed a deceptive design.

        (11) “Deidentified data” means data that cannot reasonably be used to infer information

 about, or otherwise be linked to, an identified or identifiable consumer, or a device linked to such

 a consumer. “Deidentified data” includes consumer health data in the possession of a regulated

 entity where the regulated entity:

                (A) Takes reasonable measures to ensure that such data cannot be associated with

 a consumer;

                (B) Publicly commits to maintain and process the data in a deidentified fashion

 and to not attempt to reidentify the data, except that the regulated entity may attempt to

 reidentify the information solely for the purpose of determining whether its deidentification

 processes satisfy the requirements of this paragraph; and

                (C) Contractually obligates any recipients of such data to maintain the data in a

 deidentified fashion.

        (12) “Gender-affirming care information” means personal information relating to seeking

 or obtaining past, present, or future gender-affirming care services. “Gender-affirming care

 information” includes:

                                                       4

                (A) Precise location information that could reasonably indicate a consumer’s

 attempt to acquire or receive gender-affirming care services;

                (B) Efforts to research or obtain gender-affirming care services; or

                (C) Any information related to seeking or obtaining past, present, or future

 gender-affirming care services that is derived, extrapolated, or inferred, including from non-

 health information, such as proxy, derivative, inferred, emergent, or algorithmic data.

        (13) “Gender-affirming care services” means health services or products that support and

 affirm an individual’s gender identity, including social, psychological, behavioral, cosmetic,

 medical, or surgical interventions. “Gender-affirming care services” includes treatments for

 gender dysphoria, gender-affirming hormone therapy, and gender-affirming surgical procedures.

        (14) “Genetic data” or “genetic information” means any data, regardless of its format,

 that concerns a consumer’s genetic characteristics. “Genetic data” or “genetic information”

 includes:

                (A) Raw sequence data that result from the sequencing of a consumer's complete

 extracted deoxyribonucleic acid (“DNA”) or a portion of the extracted DNA;

                (B) Genotypic and phenotypic information that results from analyzing the raw

 sequence data; and

                (C) Self-reported health data that a consumer submits to a regulated entity and

 that is analyzed in connection with consumer's raw sequence data.

        (15) “Geofence” means technology that uses global positioning coordinates, cell tower

 connectivity, cellular data, radio frequency identification, Wi-fi data, or any other form of spatial

 or location detection to establish a virtual boundary around a specific physical location, or to

                                                       5

 locate a consumer within a virtual boundary. For purposes of this definition, “geofence” means a

 virtual boundary that is 2,000 feet or less from the perimeter of the physical location.

       (16) “Health care services” means any service provided to a person to assess, measure,

 improve, or learn about a person's mental or physical health, including:

                  (A) Individual health conditions, status, diseases, or diagnoses;

                  (B) Social, psychological, behavioral, and medical interventions;

                  (C) Health-related surgeries or procedures;

                  (D) Use or purchase of medication;

                  (E) Bodily functions, vital signs, symptoms, or measurements of the information

 described in this paragraph;

                  (F) Diagnoses or diagnostic testing, treatment, or medication;

                  (G) Reproductive health care services; or

                  (H) Gender-affirming care services.

        (17) “Homepage” means the introductory page of an internet website and any internet

 webpage where personal information is collected. In the case of an online service, such as a

 mobile application, homepage means the application's platform page or download page, and a

 link within the application, such as from the application configuration, “about,” “information,” or

 settings page.

        (18) “Person” means an individual, firm, corporation, partnership, cooperative,

 association, or any other organization, legal entity, or group of individuals however organized,

 including agents thereof. The term “person” includes a regulated entity, third party, affiliate, or

 processor. The term “person or entity” shall not include the government of the United States, the

                                                        6

 District of Columbia government, or any of the agencies or instrumentalities of either

 government.

         (19) “Personal information” means information that identifies or is reasonably capable of

 being associated or linked, directly or indirectly, to a particular consumer. “Personal

 information” includes data associated with a persistent unique identifier, such as a cookie ID, an

 IP address, a device identifier, an advertising ID, or any other form of persistent unique

 identifier. “Personal information” does not include publicly available information or deidentified

 data.

         (20) “Physical or mental health status” includes:

                (A) Individual health conditions, treatment, diseases, or diagnoses;

                (B) Social, psychological, behavioral, and medical interventions;

                (C) Health-related surgeries or procedures;

                (D) Use or purchase of prescribed medications;

                (E) Bodily functions, vital signs, symptoms, or measurements of the information

 described in this paragraph;

                (F) Diagnoses or diagnostic testing, treatment, or medication;

                (G) Gender-affirming care information;

                (H) Reproductive or sexual health information;

                (I) Biometric data;

                (J) Genetic data;

                (K) Precise location information that could reasonably indicate a consumer's

 attempt to acquire or receive health services or supplies;

                (L) Data that identifies a consumer seeking health care services; or

                                                       7

                (M) Any information that a regulated entity, or their processor, processes to

 associate or identify a consumer with the data described in this paragraph that is derived or

 extrapolated from non-health information (such as proxy, derivative, inferred, or emergent data

 by any means, including algorithms or machine learning).

        (21) “Precise location information” means information derived from technology and that

 is used or intended to be used to locate a consumer within a radius of 1,750 feet.

        (22) “Process” or “processing” means any operation or set of operations performed on

 consumer health data.

        (23) “Processor” means a person that processes consumer health data on behalf of a

 regulated entity.

        (24) “Publicly available information” means information about a consumer that a

 regulated entity has reasonable cause to believe the consumer has lawfully made available to the

 general public through federal, state, or municipal government records or widely distributed

 media. “Publicly available information” does not include any biometric data collected about a

 consumer by a business without the consumer’s consent.

        (25) “Regulated entity” means any legal entity, including its agents, that conducts

 business in the District or produces or provides products or services that are targeted to

 consumers in the District and that alone or jointly with others, determines the purpose and means

 of collecting, processing, sharing, or selling consumer health data. “Regulated entity” does not

 include government agencies, tribal nations, or contracted service providers when processing

 consumer health data on behalf of a government agency.

                                                       8

        (26) “Reproductive or sexual health information” means personal information relating to

 seeking or obtaining past, present, or future reproductive or sexual health services.

 “Reproductive or sexual health information” includes:

                (A) Precise location information that could reasonably indicate a consumer's

 attempt to acquire or receive reproductive or sexual health services;

                (B) Efforts to research or obtain reproductive or sexual health services; or

                (C) Any reproductive or sexual health information that is derived, extrapolated, or

 inferred, including from non-health information (such as proxy, derivative, inferred, emergent, or

 algorithmic data).

        (27) “Reproductive or sexual health services” means health services or products that

 support or relate to a consumer's reproductive system or sexual well-being including:

                (A)