Privacy Matters | Congress turns its attention to federal privacy legislation, Kristen Rosati advocates for a national standard for de-identification, & more

Experts Expound
 

As this fortnight’s guest commentator, Kristen Rosati, a Partner at Coppersmith Brockelman, PLC and a Past President and Fellow of the American Health Law Association, advocates for a federal standard prohibiting the re-identification of individuals represented in de-identified data sets and a national standard for de-identification.

De-identified data is essential to innovation in health care. But there are headwinds developing that may threaten the continued use of de-identified data, including rumblings of requiring individual consent to use de-identified data and the prospect of federal and state requirements diverging from the HIPAA de-identification standards. To ensure the continued ability to use de-identified health care data—in a manner that rigorously protects the individuals represented in that data—the industry should push for two goals.

First, we need a strong federal prohibition on re-identification of individuals from de-identified datasets (with limited exceptions, such as IRB-approved research on re-identification or with individual consent). Currently, there are prohibitions against re-identification only in California and Arizona, and even in those states the scope of the prohibitions are limited. Without strong federal protection against re-identification, we likely will see increasing calls to require individual control over the use of de-identified data. Requiring individual consent will result in substantial costs that could shut down essential research and compromise the quality of research by introducing consent bias into data.

Second, we need to ensure the well-established HIPAA de-identification standards will be used in evolving state laws related to consumer data, patient health information, and genetic privacy. Having one consistent and well-crafted de-identification standard is crucial for research and other data collaborations involving entities across the country.

Many health care organizations are exercising good data stewardship and imposing downstream contractual protections over de-identified data to reduce the risk of re-identification of their patients. But the efforts of individual organizations will not assure the public that de-identified information is secure and will not be used to re-identify individuals. We need one federal standard that better protects individuals and preempts state laws.

Government Watcher

American Data Privacy & Protection Act

• Background: The ADPPA, or H.R. 8152, is a United States proposed federal online privacy bill that, if enacted into law, would regulate how organizations keep and use consumer data. The bipartisan, bicameral bill was the first American consumer privacy bill to pass committee markup, which it did with near unanimity. It was introduced in the House in June 2022. 
• Latest Developments: 
  Governor Newsom, Attorney General Bonta and CPPA File Letter Opposing Federal Privacy Preemption
  CA.gov (February 28, 2023)
  "Today, Governor Gavin Newsom, Attorney General Rob Bonta, and the California Privacy Protection Agency (CPPA) sent a joint letter to Congress opposing preemption language in H.R. 8152, the American Data Privacy and Protection Act (ADPPA). The ADPPA, introduced in the last Congressional session, sought to replace California’s landmark law with weaker protections and could compromise the ability of the California Privacy Protection Agency (CPPA) to fulfill its mandate to protect the privacy of Californians. California today calls on Congress to set the floor and not the ceiling in any federal privacy law, and to allow states to provide additional protections in response to changing technology and data privacy protection practices." Keep reading
  
  

The Office of Civil Rights' Annual Report on HIPAA Privacy, Security, and Breach Notification Rule Compliance + Report on Breaches of Unsecured Protected Health Information

• Background & Latest Development: The Office of Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) recently submitted two annual reports to Congress setting forth a summary of complaints and breaches reported to the OCR during calendar year 2021, as well as the enforcement actions taken by the OCR in response.
   

Illinois Biometric Information Privacy Act

• Background: On October 3, 2008, Illinois set forth the Biometric Information Privacy Act in an effort to regulate the collection, use, and handling of biometric identifiers and information by private entities. Notably, the Act does not apply to government entities. Also known as BIPA, the first-of-its-kind law has, since 2008, made Illinois the only state that grants a private right of action to sue over the improper collection and mishandling of biometric data.
• Latest Developments: 
  Illinois Supreme Court Finds that Biometric Information Privacy Act Claims Accrue with Each and Every Violation
  WilmerHale (February 23, 2023)
  "On February 17, 2023, the Illinois Supreme Court held in a 4-3 split opinion that claims under the state’s Biometric Information Privacy Act (BIPA) accrue each time there is a biometric collection or transmission constituting a potential violation, even if the same biometric identifier is being collected or transmitted by the same entity from the same individual repeatedly. This opinion follows a recent Illinois Supreme Court decision that found a five-year limitations period for BIPA claims." Keep reading

Food for Thought

How policymakers could tweak HIPAA to better protect abortion records
STAT News (February 7, 2023)
Article by Avani Kalra
"Patient privacy law offers little protection if law enforcement requests a person’s medical records — an issue that’s fueled concern as states impose restrictions on abortion after the Supreme Court overturned Roe v. Wade. 'I think it’s important to know that right now, your health records aren’t necessarily protected. And that is because HIPAA privacy protections weren’t prepared for this moment,' said Rep. Sara Jacobs (D-Calif.), referring to the Health Insurance Portability and Accountability Act, which protects patient medical records. Jacobs recently worked with Rep. Anna Eshoo (D-Calif.) to author the Secure Access for Essential Reproductive (SAFER) Health Act, which would prohibit lawmakers from sharing personal health information related to abortion or pregnancy loss without patient consent." Keep reading