The Health Information Privacy Reform Act has cleared the Senate Health, Education, Labor, and Pensions Committee. Every member of the panel voted in favor on August 7, sending the bill to the full chamber.
The legislation, introduced in November 2025 by committee chair Sen. Bill Cassidy of Louisiana, would extend HIPAA-style protections to health data collected outside the HIPAA-covered world, including information gathered by health apps, fitness trackers, wearables, and other consumer health devices. Under current law, much of that data falls outside HIPAA even though it would be protected if a provider or health plan held it.
For consumers, the payoff would be meaningful: their records could be wiped at their request inside of a month, with safeguards on par with what the current regime already extends. The drafting burden lands on HHS, working with the FTC, which would have a year and a half to complete standards for how data is guarded, how losses are reported, and how personal information is handled, applying to covered businesses and their contractors. Patient information would also be subject to strict use limits: some applications of the data allowed, others off the table, access trimmed to what a task actually requires, and collection kept lean.
A separate provision targets artificial intelligence, giving the HHS Office for Civil Rights 12 months to explain how the minimum necessary standard governs machine learning systems that work with protected health data. Covered entities, meanwhile, must alert individuals when information turned over in response to a right of access request no longer falls under HIPAA protections.
The measure enjoys bipartisan support, but whether that support holds through votes in the full Senate and House remains unclear.
