The Senate Health Education Labor and Pension committee voted unanimously to advance legislation extending HIPAA-like protections to consumer health data currently outside regulatory scope. If enacted, you'll need privacy and security controls for wearables, health apps, and fitness platforms that mirror those for clinical systems. Here's how to prepare before the rule drops.
The Problem: Your Compliance Perimeter Just Expanded
Your organization handles health data that doesn't touch a covered entity. Maybe you're building a menstrual tracking app, a glucose monitor that syncs to phones, or an AI-driven symptom checker. Until now, that data lived under the FTC with vague guidance and enforcement-by-settlement. The proposed bill directs the Department of Health and Human Services, working with the Federal Trade Commission, to establish HIPAA privacy, security, and breach notification protections for this non-covered data.
This matters because you're about to inherit obligations you didn't design for. HIPAA Security Rule controls assume clinical workflows, BAA chains, and designated privacy officers. Your product team built for speed and user experience, not for minimum necessary disclosures or 72-Hour Notification Requirements. The gap between where you are and where the rule will put you is real, and closing it takes months, not weeks.
What You Need Before Starting
Inventory every health data touchpoint. You can't scope controls until you know what you're protecting. Document:
- Data sources (wearable APIs, user input forms, third-party integrations)
- Storage locations (cloud databases, analytics warehouses, backup systems)
- Processing activities (ML model training, aggregation, third-party sharing)
- Retention periods (active user data, deleted account remnants, logs)
Map your current privacy posture. Pull your existing privacy policy, consent flows, and data-sharing agreements. Note where you already limit use, where you sell data, and where you rely on broad user consent. The bill would require authorization before selling data to third parties and notification when data leaves HIPAA protection, so flag every sale or transfer now.
Identify your HIPAA analogs. You don't have a covered entity structure, but you'll need equivalent roles. Assign someone to act as your privacy lead (the HIPAA Privacy Officer equivalent) and someone to own security controls (Security Officer). These can't be the same person who ships product features; they need authority to say no.
Assess your technical baseline. Run a quick audit:
- Encryption at rest and in transit (required under HIPAA Security Rule § 164.312(a)(2)(iv) and § 164.312(e)(2)(ii))
- Access controls and authentication (Role-Based Access Control, multi-factor for admin access)
- Audit logging (who accessed what data, when)
- Incident response capability (detection, containment, notification workflows)
If you're missing any of these, you're starting from scratch in that domain.
Step-by-Step Implementation
Phase 1: Privacy Framework (Weeks 1-4)
Build your minimum necessary standard. HIPAA's minimum necessary requirement (Privacy Rule § 164.502(b)) means you only collect, use, and disclose the minimum data needed for a specific purpose. For each data element you collect:
- Document why you need it
- Define who internally can access it
- Set retention limits tied to purpose
The bill also calls for HHS guidance on applying minimum necessary to AI and machine learning within one year of enactment. Until that guidance arrives, apply the principle conservatively: if your ML model can achieve its goal with aggregated or de-identified data, don't train it on identifiable records.
Draft required notices. You'll need:
- A HIPAA-style Notice of Privacy Practices explaining uses, disclosures, and individual rights
- Point-of-collection notices when data leaves HIPAA protection (required by the proposed bill for organizations receiving data through Right of Access)
- Authorization forms for data sales that meet HIPAA's valid authorization elements (description of information, purpose, expiration, right to revoke)
Establish individual rights workflows. Users will gain rights similar to Data Subject Access Requests under GDPR:
- Access: Provide a copy of their data within 30 days (note: HHS OCR plans to propose shortening this to 15 days in November)
- Correction: Allow amendment of inaccurate data
- Accounting: Disclose where you've shared their data
Build ticket queues, response templates, and verification procedures now. Identity verification is critical; the planned HIPAA Privacy Rule update will prohibit unreasonable verification measures, so design a process that balances security with accessibility.
Phase 2: Security Controls (Weeks 5-8)
Implement encryption everywhere. This is non-negotiable:
- At rest: AES-256 for databases, file systems, and backups
- In transit: TLS 1.3 for all API calls, web traffic, and third-party integrations
- Key management: Separate encryption keys from data; rotate annually
Lock down access. Apply Principle of Least Privilege:
- Role-Based Access Control tied to job function
- Just-in-Time Access for administrative tasks
- Privileged Access Management for production database access
- Quarterly access reviews to remove stale permissions
Enable comprehensive logging. Capture:
- Authentication events (logins, failures, MFA challenges)
- Data access (queries, exports, API calls)
- Configuration changes (permission updates, encryption key rotations)
- Security events (firewall blocks, intrusion detection alerts)
Retain logs for at least six years to match HIPAA's documentation retention requirement (§ 164.316(b)(2)(i)).
Build your incident response plan. You'll need breach notification procedures modeled on HIPAA:
- Detection and assessment workflow
- Containment, Eradication, and Recovery steps
- Notification triggers (what constitutes a breach requiring disclosure)
- Templates for individual notification, HHS reporting, and media notification if breach affects 500+ individuals
Designate a Computer Security Incident Response Team with defined roles and contact procedures.
Phase 3: Vendor and Partner Controls (Weeks 9-10)
Map your third-party data flows. Every vendor that touches health data needs a contract with HIPAA-like obligations. The proposed bill extends protections to service providers, so you'll need Business Associate Agreement equivalents that:
- Limit use and disclosure to contracted services
- Require security safeguards
- Mandate breach notification
- Prohibit further disclosure without authorization
Audit high-risk vendors. Prioritize cloud infrastructure, analytics platforms, and any vendor that stores or processes identifiable health data. Request SOC 2 Type II reports or conduct your own security assessments.
Phase 4: Documentation and Training (Weeks 11-12)
Create your compliance documentation set:
- Policies and procedures covering all HIPAA Security Rule administrative, physical, and technical safeguards
- Risk assessment documenting threats, vulnerabilities, and mitigation controls
- Statement of Applicability mapping your controls to the new requirements
- Training materials for workforce members handling health data
Train your team. Everyone who touches health data needs annual privacy and security training covering:
- What constitutes protected health data under the new rule
- Permitted uses and disclosures
- Individual rights and how to respond
- Breach identification and reporting
- Sanctions for violations
Validation: How to Verify It Works
Run tabletop exercises. Simulate:
- A user submitting a Right of Access request
- A vendor breach requiring notification
- An unauthorized access incident detected in logs
- A data sale request requiring authorization
Time each scenario. Can you respond to an access request in 15 days? Can you determine breach scope within hours?
Conduct a technical audit. Verify:
- All databases are encrypted at rest (query your cloud provider's encryption status)
- All API endpoints enforce TLS 1.3 (use SSL Labs or similar scanner)
- Access controls are enforced (attempt to access data without proper role assignment)
- Logs capture required events (review a sample week of authentication and access logs)
Test your vendor chain. Send a mock breach notification to your top five vendors. Do they have procedures to respond? Can they provide you with the data you'd need to assess impact?
Validate consent and authorization flows. Walk through your user journey:
- Is the privacy notice presented before data collection?
- Does the authorization form for data sales include all required elements?
- Can a user easily revoke authorization?
Maintenance: Ongoing Tasks
Quarterly access reviews. Pull a report of all users with access to health data. Verify each person still needs that access level. Remove anyone who changed roles or left the organization.
Annual risk assessments. HIPAA Security Rule § 164.308(a)(1)(ii)(A) requires periodic risk assessments. Document new threats (emerging attack vectors, new third-party integrations), reassess existing controls, and update your risk treatment plan.
Monthly log reviews. Don't wait for an incident. Review authentication failures, unusual access patterns, and configuration changes. Set up automated alerts for high-risk events (admin account creation, bulk data exports, encryption key access).
Vendor audits. Annually review SOC 2 reports for critical vendors. Every three years, conduct on-site or virtual assessments of vendors handling large volumes of health data.
Training refreshers. Annual training is the minimum. When you update privacy practices, launch new features that touch health data, or experience a breach, conduct targeted training for affected teams.
Regulatory monitoring. HHS OCR plans to issue guidance on minimum necessary for AI within one year of enactment. The Department of Health and Human Services is also finalizing HIPAA Privacy Rule modifications to improve patient access and care coordination. Subscribe to OCR guidance updates and adjust your controls as new requirements emerge.
The 22-0 committee vote signals strong bipartisan support, but the bill still needs full Senate approval, House action, and presidential signature. Use the legislative timeline to your advantage. Build these controls now, and you'll be ready when the rule takes effect instead of scrambling to catch up under enforcement pressure.
