In November 2025, Senator Bill Cassidy, (R-LA) introduced the Health Information Privacy Reform Act (HIPRA), legislation aimed at closing gaps in federal health data protections for health information that is not covered under the Health Insurance Portability and Accountability Act (HIPAA). According to Cassidy's press release, the original HIPRA bill was intended to “expand health privacy protections to account for new technologies that are not currently required to have privacy protections, such as wearables and health apps.”
On July 30, 2026, the Senate Committee on Health, Education, Labor, and Pensions (HELP) voted unanimously, 22-0, to advance HIPRA out of committee through a manager’s amendment.
Key Changes in the Manager’s Amendment
In Congress, a manager’s amendment—also known as a substitute—is a package of negotiated changes offered by the bill’s manager, typically the committee’s chair. As HELP Committee chair, Cassidy offered such an amendment before HIPRA advanced out of committee, substantially rewriting the introduced bill. The substitute consolidates the bill from nine substantive sections to six and significantly revises its core privacy and security framework.
Among the most significant changes are:
- 18-month rulemaking deadline. The Department of Health and Human Services (HHS) would be required to issue implementing regulations within 18 months of enactment.
- New data minimization and retention limits. Regulated entities and service providers (both defined terms under the bill) could not collect, process, or retain applicable health information beyond what is reasonably necessary, subject to exceptions for activities such as completing a requested transaction, legal compliance, fraud prevention, and research governed by an Institutional Review Board (IRB).
- Expanded geolocation protections. The definition of “applicable health information” would expand to include precise geolocation information that could reasonably indicate an attempt to obtain a health care service or supply, targeting location tracking related to health care.
- New carve-outs. The substitute adds express exclusions for information already regulated under the Gramm–Leach–Bliley Act, 42 CFR Part 2 substance use disorder confidentiality rules, the Family Educational Rights and Privacy Act, human-subjects research regulations, Good Clinical Practice guidelines, the Health Care Quality Improvement Act, and patient safety work product under the Patient Safety and Quality Improvement Act.
- New “data broker” category and government-access restriction. The substitute adds a new “data broker” definition and would bar regulated entities and service providers from selling or transferring applicable health information to any federal, state, local, or Tribal government entity absent a warrant, subpoena, court order, or other compulsory process.
- Broader authorization requirements. Written authorization—including an express right to revoke—would be required for any sale, license, transfer, or marketing of applicable health information, replacing the bill’s more general authorization.
- Health care access protection. Permitted-use regulations could not authorize disclosures to investigate or impose liability on an individual for seeking, obtaining, providing, or facilitating health care.
- Mandatory AI-specific rulemaking. Rather than issuing general guidance, HHS—working with the FDA commissioner and the Office of the National Coordinator for Health Information Technology—would be required to issue binding regulations on how the minimum necessary standard applies to data used to train, validate, and operate artificial intelligence (AI) and machine-learning models, with mandatory review at least every three years.
- Tighter de-identification standard. The de-identification standard would require at least HIPAA's "expert determination" method; HIPAA's more permissive “safe harbor” method alone would no longer be sufficient. The substitute also adds an express prohibition on re-identification, enforceable through the bill’s civil penalty provisions.
- New FTC-HHS enforcement coordination. HHS and the Federal Trade Commission (FTC) would be required to enter into a memorandum of understanding within 180 days of enactment to allocate primary enforcement responsibility and avoid duplicative civil penalties for the same conduct.
- Provisions removed. The introduced bill’s separate patient-notification requirements for right-of-access disclosures and wellness data, as well as its provision directing a National Academies study on compensating patients for data sharing, do not appear in the manager’s amendment.
Taken together, the manager’s amendment moves HIPRA closer to a comprehensive federal privacy law framework by emphasizing limitations on data use, particularly for sensitive data types held by a range of persons and entities not already covered by HIPAA.
For more in-depth analysis of the original bill, please see our prior blog post.
What Happened at the HELP Committee Markup?
During the markup, Cassidy framed HIPRA as part of a broader legislative agenda focused on “protecting [Americans’] health and making life more affordable,” positioning the bill alongside other bipartisan efforts advanced by the HELP Committee in recent weeks.
Cassidy emphasized that “ensuring that patients have robust privacy protections in place is essential to take full advantage of modern technology” and noted that “Americans have few legal protections and control over their health information captured by devices.” He described HIPRA as creating “a framework so that health data that is not covered by HIPAA is subject to robust privacy protections.”
Notably, HIPRA has bipartisan support. Senator Maggie Hassan (D-NH) cosponsored the legislation, no members of the HELP Committee spoke in opposition, and no amendments were offered to the bill beyond the manager’s amendment.
What Happens Next?
HELP Committee approval is an important step, but HIPRA still faces a lengthy path to becoming law. The bill has been placed on the Senate Legislative Calendar, making it eligible for consideration by the full Senate. If HIPRA is passed by the Senate, the legislation would then move to the House. Any differences between the House and Senate versions would need to be resolved before the legislation could be sent to the President for signature or veto.
The biggest hurdle may be securing Senate floor time and maintaining sufficient bipartisan support for passage. However, the unanimous 22-0 committee vote is a strong signal of bipartisan consensus, which may help HIPRA’s prospects on the Senate floor.
HIPRA seeks to address a policy gap by extending HIPAA-like protections to health data held by certain non-HIPAA entities, including wellness apps, wearables, and consumer health technology companies. But it may also face backlash from digital health companies, ad-tech platforms, and health-app developers.
What Should Businesses Do Next?
No immediate compliance action is required, but companies in health care, digital health, or health advertising should treat the favorable HELP Committee vote as the beginning of a potentially significant legislative process, not the end of one.
Given the scope of the manager’s amendment, companies that collect, use, or monetize consumer health data—particularly wearables, health apps, AI and machine-learning developers, and data brokers—should begin assessing how the current draft bill’s data minimization, retention, authorization, geolocation, deletion, and de-identification requirements would apply to their current practices.
Companies should continue to monitor developments closely as HIPRA moves toward the Senate floor and assess how future legislative changes could affect their operations.
We will continue to monitor HIPRA as it moves through Congress and provide updates on significant developments. Please contact your Alston & Bird team with questions about HIPAA, the proposed HIPRA legislation, or evolving privacy issues involving wearables, health apps, AI and machine-learning developers, and data brokers.
AlstonHealth State Law Hub
Alston & Bird’s Health Care team highlights state legislation and regulatory actions with direct implications for operations, reimbursement, privacy, and enforcement risk. Designed for in-house counsel, the tracker supports legal teams in proactively managing risk and aligning business strategy with a rapidly evolving state regulatory environment.
Learn more on the AlstonHealth State Law Hub.
Ransomware Fusion Center
Stay ahead of evolving ransomware threats with Alston & Bird's Ransomware Fusion Center. Our Privacy, Cyber & Data Strategy Team offers comprehensive resources and expert guidance to help your organization prepare for and respond to ransomware incidents. Visit Alston & Bird's Ransomware Fusion Center to learn more and access our tools.
If you have any questions, or would like additional information, please contact one of the attorneys on our Health Care team or one of the attorneys on our Privacy, Cyber & Data Strategy team.
You can subscribe to future advisories and other Alston & Bird publications by completing our publications subscription form.