H.R. 7472, Secure Data and Privacy for Contact Tracing Act
Summary
H.R. 7472, the Secure Data and Privacy for Contact Tracing Act of 2020, was introduced in the House of Representatives on July 1, 2020 by Ms. Speier and referred to the Committee on Energy and Commerce. It would have the Director of the Centers for Disease Control and Prevention award grants to eligible State, Tribal, and territorial public health agencies for digital contact tracing for COVID-19. An agency whose technology does not meet each listed requirement would be ineligible for grant funds and other Federal funds for that technology. The requirements include that the technology be voluntary for the user. It authorizes $75,000,000, to remain available until expended.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
- Issuer
- Congressional materials
- Document type
- Bills Bills 116Hr7472Ih Bills 116Hr7472Ih
- Case
- Bills Bills 116Hr7472Ih Bills 116Hr7472Ih
Cite this document
“H.R. 7472, Secure Data and Privacy for Contact Tracing Act.”
Original at www.govinfo.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/bills-bills-116hr7472ih-bills-116hr7472ih/
, SHA-256 f521700aea2e608f37d226d9a5ae8aa0da43312d5421c4c8a0c50976539926a7.Full text
I
116TH CONGRESS
2D SESSION
H. R. 7472
To authorize the Director of the Centers for Disease Control and Prevention
to award grants to eligible State, Tribal, and territorial public health
agencies to develop and administer a program for digital contact tracing
for COVID–19, and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
JULY 1, 2020
Ms. SPEIER (for herself, Ms. DEGETTE, Mrs. DINGELL, Mr. CARSON of Indi-
ana, Ms. BARRAGÁN, Mr. LYNCH, Mr. RASKIN, Mr. SAN NICOLAS, Mr.
TAKANO, and Mr. HASTINGS) introduced the following bill; which was re-
ferred to the Committee on Energy and Commerce
A BILL
To authorize the Director of the Centers for Disease Control
and Prevention to award grants to eligible State, Tribal,
and territorial public health agencies to develop and ad-
minister a program for digital contact tracing for
COVID–19, and for other purposes.
1 Be it enacted by the Senate and House of Representa-
2 tives of the United States of America in Congress assembled,
3 SECTION 1. SHORT TITLE.
4 This Act may be cited as the ‘‘Secure Data and Pri-
pbinns on DSKJLVW7X2PROD with BILLS
5 vacy for Contact Tracing Act of 2020’’.
VerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472
2
1 SEC. 2. GRANT PROGRAM FOR DIGITAL CONTACT TRACING
2 FOR COVID–19.
3 (a) IN GENERAL.—The Director of the Centers for
4 Disease Control and Prevention shall award grants to eli-
5 gible State, Tribal, and territorial public health agencies
6 to—
7 (1) establish a contact-tracing program that im-
8 plements traditional contact tracing protocols with
9 the assistance of digital contact tracing technology
10 to track and prevent the spread of COVID–19; or
11 (2) incorporate digital contact tracing tech-
12 nology into a contact-tracing program that imple-
13 ments traditional contact tracing protocols to track
14 and prevent the spread of COVID–19.
15 (b) FUNDING DISQUALIFICATION.—If a State, Trib-
16 al, or territorial public health agency develops or procures
17 any digital contact tracing technology with respect to
18 COVID–19 that does not meet each of the requirements
19 listed in subsection (c), such State, Tribal, or territorial
20 public health agency shall be ineligible to receive or con-
21 tinue to receive—
22 (1) any funds through a grant under this sec-
23 tion; and
24 (2) any other Federal funds, including under
pbinns on DSKJLVW7X2PROD with BILLS
25 the CARES Act (Public Law 116–136), for any dig-
•HR 7472 IH
VerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472
3
1 ital contact-tracing technology with respect to
2 COVID–19.
3 (c) DIGITAL CONTACT-TRACING REQUIREMENTS.—A
4 State, Tribal, or territorial public health agency may use
5 a grant under this section for digital contact tracing tech-
6 nology, as described in subsection (a), only if the tech-
7 nology meets each of the following requirements:
8 (1) The technology shall be voluntary for the
9 user and provide to the user complete and clear in-
10 formation on the intended use and processing of
11 data collected by the technology. To be voluntary for
12 the user, the technology shall meet requirements in-
13 cluding each of the following:
14 (A) Use of the technology and of contact-
15 tracing data collected using the technology shall
16 be predicated on the user’s affirmative consent.
17 (B) Use of the technology shall not be a
18 condition for the reception of government bene-
19 fits.
20 (C) Use of the technology shall not be
21 made a condition of employment or employment
22 status.
23 (2) The technology shall limit the collection of
24 data by the technology to only the data that is nec-
pbinns on DSKJLVW7X2PROD with BILLS •HR 7472 IH
VerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472
4
1 essary to meet contact-tracing objectives, includ-
2 ing—
3 (A) the status of any person as an infected
4 or potentially infected person; and
5 (B) the proximity of a person to someone
6 who is symptomatic or has tested positive.
7 (3) The technology—
8 (A) shall delete or de-identify any contact-
9 tracing data that is individually identifiable in-
10 formation not later than the date that is 30
11 days after the end of the COVID–19 emergency
12 declaration; and
13 (B) shall include notifications to prompt
14 users to disable or completely remove any dig-
15 ital contact-tracing technology where practical.
16 (4) The technology shall have robust contact
17 detection specifications, including for distance and
18 time, that allow for detection consistent with guid-
19 ance of the Centers for Disease Control and Preven-
20 tion on COVID–19.
21 (5) The technology shall ensure that the storing
22 of proximity and any contact-tracing data is
23 encrypted to the maximum extent possible.
pbinns on DSKJLVW7X2PROD with BILLS •HR 7472 IH
VerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472
5
1 (d) PLAN FOR INTEROPERABILITY.—As a condition
2 on receipt of a grant under this section, a State, Tribal,
3 or territorial public health agency shall—
4 (1) develop and make publicly available a plan
5 for how the digital contact-tracing technology of the
6 agency with respect to COVID–19 augments—
7 (A) traditional contact tracing efforts, if
8 applicable; and
9 (B) statewide efforts to prevent, prepare
10 for, and respond to COVID–19; and
11 (2) include in such plan a description of the
12 agency’s efforts to ensure that the digital contact-
13 tracing technologies of the agency with respect to
14 COVID–19 are interoperable with the digital con-
15 tact-tracing technology and public health agency
16 databases of other jurisdictions with respect to
17 COVID–19; and
18 (3) ensure that data collected by the digital
19 contact-tracing technology of the agency—
20 (A) is accessed and processed only by pub-
21 lic health authorities (or their designees); and
22 (B) is not shared with any person, or
23 accessed or used by any person, for any purpose
24 other than diagnosis, containment, treatment,
pbinns on DSKJLVW7X2PROD with BILLS
25 or reduction of, or research into, COVID–19.
•HR 7472 IH
VerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472
6
1 (e) INDEPENDENT SECURITY ASSESSMENTS.—
2 (1) IN GENERAL.—As a condition on receipt of
3 a grant under this section, a State, Tribal, or terri-
4 torial public health agency shall—
5 (A) establish procedures for completing or
6 obtaining independent security assessments of
7 digital contact-tracing infrastructure to ensure
8 that physical and network security is resilient
9 and secure; and
10 (B) develop a process to address the miti-
11 gation or remediation of the security
12 vulnerabilities discovered during such inde-
13 pendent security assessments.
14 (2) SOURCE CODE.—A State, Tribal, or terri-
15 torial public health agency should consider making
16 public the source code of the digital contact-tracing
17 technology used by the agency.
18 (f) APPLICATION.—To seek a grant under this sec-
19 tion, an eligible State, Tribal, or territorial public health
20 agency shall submit an application in such form, in such
21 manner, and containing such information and assurances
22 as the Director may require.
23 (g) SECURING DIGITAL CONTACT-TRACING DATA.—
24 (1) IN GENERAL.—The provisions of the
pbinns on DSKJLVW7X2PROD with BILLS
25 HIPAA privacy and security law (as defined in sec-
•HR 7472 IH
VerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472
7
1 tion 3009(a)(2) of the Public Health Service Act (42
2 U.S.C. 300jj–19(a)(2))) shall apply to a State, Trib-
3 al, or territorial public health agency receiving a
4 grant under subsection (a) with respect to individ-
5 ually identifiable health information (as defined in
6 section 1171(a)(6) of the Social Security Act (42
7 U.S.C. 1320d(a)(6))) received by, maintained on, or
8 transmitted through a contact-tracing program de-
9 scribed in such subsection (a) in the same manner
10 as such provisions apply with respect to such infor-
11 mation and a covered entity (as defined in section
12 13400(3) of the HITECH Act (42 U.S.C.
13 17921(3))).
14 (2) BUSINESS ASSOCIATES.—
15 (A) IN GENERAL.—Any entity with a con-
16 tract in effect with an agency described in para-
17 graph (1) for the development, maintenance, or
18 operation of a program described in such para-
19 graph shall be deemed to be a business asso-
20 ciate of such agency for purposes of subtitle D
21 of the HITECH Act (42 U.S.C. 17921 et seq.).
22 (B) REVISION OF SAMPLE AGREEMENT.—
23 Not later than 180 days after the date of the
24 enactment of this Act, the Secretary shall revise
pbinns on DSKJLVW7X2PROD with BILLS
25 the sample business associate agreement provi-
•HR 7472 IH
VerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472
8
1 sions published on January 25, 2013, to take
2 account of the provisions of this subsection.
3 (C) EFFECTIVE DATE.—The provisions of
4 subparagraph (A) shall apply beginning on the
5 day after the Secretary revises the provisions
6 described in subparagraph (B).
7 (h) LIMITATION ON USE OF DATA.—Data generated
8 in connection with the operation of digital contact tracing
9 technology funded pursuant to this section may not be
10 used for any punitive purpose, including law enforcement,
11 immigration enforcement, or criminal prosecution. Such
12 data and any information derived from it, whether in
13 whole or in part, may not be received as evidence in any
14 trial, hearing, or other proceeding in or before any court,
15 grand jury, department, officer, agency, regulatory body,
16 legislative committee, or other authority of the United
17 States, a State, or a political subdivision thereof.
18 (i) REPORT TO CONGRESS.—Not later than 90 days
19 after the date of enactment of this Act, the Comptroller
20 General of the United States shall—
21 (1) evaluate the outcome of the grants awarded
22 under this section, including an assessment of the
23 impact of the implementation of digital contact-trac-
24 ing programs funded through such grants on the
pbinns on DSKJLVW7X2PROD with BILLS
25 spread of COVID–19; and
•HR 7472 IH
VerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472
9
1 (2) submit to the Congress a report on the re-
2 sults of such evaluation.
3 (j) DEFINITIONS.—In this section:
4 (1) AFFIRMATIVE EXPRESS CONSENT.—The
5 term ‘‘affirmative express consent’’ means an affirm-
6 ative act by an individual that clearly and conspicu-
7 ously communicates the individual’s authorization
8 for an act or practice, in response to a specific re-
9 quest that—
10 (A) is provided to the individual in a clear
11 and conspicuous disclosure that is separate
12 from other options or acceptance of general
13 terms;
14 (B) includes a description of each act or
15 practice for which the individual’s consent is
16 sought and—
17 (i) is written clearly and unmistakably
18 stated; and
19 (ii) includes a prominent heading that
20 would enable a reasonable individual to
21 identify and understand the act or prac-
22 tice; and
23 (C) cannot be inferred from inaction.
pbinns on DSKJLVW7X2PROD with BILLS •HR 7472 IH
VerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472
10
1 (2) CONTACT-TRACING DATA.—The term ‘‘con-
2 tact-tracing data’’ means information linked or rea-
3 sonably linkable to a user or device, that—
4 (A) concerns the COVID–19 pandemic;
5 and
6 (B) is gathered, processed, or transferred
7 by digital contact tracing technology.
8 (3) COVID–19 EMERGENCY DECLARATION.—
9 The term ‘‘COVID–19 emergency declaration’’ has
10 the meaning given to such term in section
11 1135(g)(1)(B) of the Social Security Act (42 U.S.C.
12 1320b–5).
13 (4) DE-IDENTIFY.—The term ‘‘de-identify’’
14 means to ensure that information cannot reasonably
15 identify, relate to, describe, be capable of being asso-
16 ciated with, or be linked, directly or indirectly, to a
17 particular individual.
18 (5) DESIGNEE.—The term ‘‘designee’’—
19 (A) subject to subparagraph (B), means
20 any person or entity, other than a public health
21 agency, that collects, processes, or transfers
22 contact-tracing data in the course of performing
23 a service or function on behalf of, for the ben-
24 efit of, under instruction of, and under contrac-
pbinns on DSKJLVW7X2PROD with BILLS •HR 7472 IH
VerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472
11
1 tual agreement with a public health authority;
2 and
3 (B) excludes any Federal, State, Tribal,
4 territorial, or local law (including immigration
5 law) enforcement personnel or entity.
6 (6) DIGITAL CONTACT-TRACING TECH-
7 NOLOGY.—
8 (A) IN GENERAL.—The term ‘‘digital con-
9 tact-tracing technology’’ means a website, on-
10 line application, mobile application, mobile oper-
11 ating system feature, or smart device applica-
12 tion that is designed, in part or in full, for the
13 purpose of—
14 (i) determining that a contact incident
15 has occurred relating to the COVID–19
16 pandemic; and
17 (ii) taking consequent steps such as
18 reporting the incident to a public health
19 authority or user, or providing guidance or
20 instructions to the user of the mobile de-
21 vice or the user’s household.
22 (B) LIMITATIONS.—Such term does not in-
23 clude any technology to assist individuals to
24 evaluate whether they are experiencing COVID–
pbinns on DSKJLVW7X2PROD with BILLS •HR 7472 IH
VerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472
12
1 19 symptoms to the extent the technology is not
2 used as described in subparagraph (A).
3 (7) DIRECTOR.—The term ‘‘Director’’ means
4 the Director of the Centers for Disease Control and
5 Prevention.
6 (8) MOBILE APPLICATION.—The term ‘‘mobile
7 application’’ means a software program that runs on
8 the operating system of a mobile device.
9 (9) MOBILE DEVICE.—The term ‘‘mobile de-
10 vice’’ means a smartphone, tablet computer, or simi-
11 lar portable computing device that transmits data
12 over a wireless connection.
13 (10) SOURCE CODE.—The term ‘‘source code’’
14 is the programming instruction for a computer pro-
15 gram in its original form and saved in a file.
16 (11) TRADITIONAL CONTACT TRACING.—The
17 term ‘‘traditional contact tracing’’ means contact
18 tracing by traditional means prior to contemporary
19 digital contact tracing.
20 (12) USER.—The term ‘‘user’’ means a member
21 of the public who utilizes the software or hardware
22 product.
pbinns on DSKJLVW7X2PROD with BILLS •HR 7472 IH
VerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H7472.IH H7472
13
1 (k) AUTHORIZATION OF APPROPRIATIONS.—To carry
2 out this section, there are authorized to be appropriated
3 $75,000,000, to remain available until expended.
Æ
pbinns on DSKJLVW7X2PROD with BILLS •HR 7472 IH
VerDate Sep 11 2014 04:52 Jul 27, 2020 Jkt 099200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6301 E:\BILLS\H7472.IH H7472
File and source
- File
- BILLS_bills-116hr7472ih_bills-116hr7472ih.pdf
- Size
- 246,888 bytes
- SHA-256
- f521700aea2e608f37d226d9a5ae8aa0da43312d5421c4c8a0c50976539926a7
- Original
- www.govinfo.gov