S. 5027, Secure Data and Privacy for Contact Tracing Act of 2020
Summary
S. 5027, the Secure Data and Privacy for Contact Tracing Act of 2020, was introduced December 16, 2020 by Mr. Schatz (for himself and Ms. Baldwin) and referred to the Committee on Health, Education, Labor, and Pensions. It would direct the Director of the Centers for Disease Control and Prevention to award grants to eligible State, Tribal, and territorial public health agencies for digital contact tracing for COVID–19. An agency that develops or procures digital contact-tracing technology not meeting the listed requirements would be ineligible for grant funds. The last section authorizes $75,000,000, to remain available until expended.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
- Issuer
- Congressional materials
- Document type
- Bills Bills 116S5027Is Bills 116S5027Is
- Case
- Bills Bills 116S5027Is Bills 116S5027Is
Cite this document
“S. 5027, Secure Data and Privacy for Contact Tracing Act of 2020.”
Original at www.govinfo.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/bills-bills-116s5027is-bills-116s5027is/
, SHA-256 c57fc0d812b19ee21672b7da858a924043ef8ea05156ceeae9810ebe15228652.Full text
II
116TH CONGRESS
2D SESSION
S. 5027
To authorize the Director of the Centers for Disease Control and Prevention
to award grants to eligible State, Tribal, and territorial public health
agencies to develop and administer a program for digital contact tracing
for COVID–19, and for other purposes.
IN THE SENATE OF THE UNITED STATES
DECEMBER 16, 2020
Mr. SCHATZ (for himself and Ms. BALDWIN) introduced the following bill;
which was read twice and referred to the Committee on Health, Edu-
cation, Labor, and Pensions
A BILL
To authorize the Director of the Centers for Disease Control
and Prevention to award grants to eligible State, Tribal,
and territorial public health agencies to develop and ad-
minister a program for digital contact tracing for
COVID–19, and for other purposes.
1 Be it enacted by the Senate and House of Representa-
2 tives of the United States of America in Congress assembled,
3 SECTION 1. SHORT TITLE.
4 This Act may be cited as the ‘‘Secure Data and Pri-
5 vacy for Contact Tracing Act of 2020’’.
VerDate Sep 11 2014 19:58 Jan 01, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S5027.IS S5027
2
1 SEC. 2. GRANT PROGRAM FOR DIGITAL CONTACT TRACING
2 FOR COVID–19.
3 (a) IN GENERAL.—The Director of the Centers for
4 Disease Control and Prevention shall award grants to eli-
5 gible State, Tribal, and territorial public health agencies
6 to—
7 (1) establish a contact tracing program that im-
8 plements traditional contact tracing protocols with
9 the assistance of digital contact-tracing technology
10 to track and prevent the spread of COVID–19;
11 (2) incorporate digital contact-tracing tech-
12 nology into a contact tracing program that imple-
13 ments traditional contact tracing protocols to track
14 and prevent the spread of COVID–19; and
15 (3) expand or maintain an existing program as
16 described in paragraph (1).
17 (b) USE OF FUNDS.—Grant funding may be used for
18 the development, maintenance, or staffing of digital con-
19 tact tracing programs, associated outreach and marketing,
20 or other activities identified by a State, Tribal, or terri-
21 torial public health agency that advance the effectiveness
22 and reach of digital contact-tracing technologies.
23 (c) FUNDING DISQUALIFICATION.—If a State, Trib-
24 al, or territorial public health agency develops or procures
25 any digital contact-tracing technology with respect to
26 COVID–19 that does not meet each of the requirements
•S 5027 IS
VerDate Sep 11 2014 19:58 Jan 01, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S5027.IS S5027
3
1 listed in subsection (d), such State, Tribal, or territorial
2 public health agency shall be ineligible to receive or con-
3 tinue to receive—
4 (1) any funds through a grant under this sec-
5 tion; and
6 (2) any other Federal funds, including under
7 the CARES Act (Public Law 116–136), for any dig-
8 ital contact-tracing technology with respect to
9 COVID–19.
10 (d) DIGITAL CONTACT-TRACING REQUIREMENTS.—
11 A State, Tribal, or territorial public health agency may
12 use a grant under this section for digital contact-tracing
13 technology, as described in subsections (a) and (b), only
14 if the technology meets each of the following requirements:
15 (1) The technology shall be voluntary for the
16 user and provide to the user complete and clear in-
17 formation on the intended use and processing of
18 data collected by the technology. To be voluntary for
19 the user, the technology shall meet requirements in-
20 cluding each of the following:
21 (A) Use of the technology and of contact-
22 tracing data collected using the technology shall
23 be predicated on the user’s affirmative consent.
•S 5027 IS
VerDate Sep 11 2014 19:58 Jan 01, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S5027.IS S5027
4
1 (B) Use of the technology shall not be a
2 condition for the reception of government bene-
3 fits.
4 (C) Use of the technology shall not be
5 made a condition of employment or employment
6 status.
7 (2) The technology shall limit the collection of
8 data by the technology to only the data that is nec-
9 essary to meet contact tracing objectives, includ-
10 ing—
11 (A) the status of any person as an infected
12 or potentially infected person; and
13 (B) the proximity of a person to someone
14 who is symptomatic or has tested positive.
15 (3) The technology—
16 (A) shall delete or de-identify any contact-
17 tracing data that is individually identifiable in-
18 formation not later than the date that is 30
19 days after the end of the COVID–19 emergency
20 declaration; and
21 (B) shall include notifications to prompt
22 users to disable or completely remove any dig-
23 ital contact-tracing technology where practical.
24 (4) The technology shall have robust contact
25 detection specifications, including for distance and
•S 5027 IS
VerDate Sep 11 2014 19:58 Jan 01, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S5027.IS S5027
5
1 time, that allow for detection consistent with guid-
2 ance of the Centers for Disease Control and Preven-
3 tion on COVID–19.
4 (5) The technology shall ensure that the storing
5 of proximity and any contact-tracing data is
6 encrypted to the maximum extent possible.
7 (e) PLAN FOR INTEROPERABILITY.—As a condition
8 on receipt of a grant under this section, a State, Tribal,
9 or territorial public health agency shall—
10 (1) develop and make publicly available a plan
11 for how the digital contact-tracing technology of the
12 agency with respect to COVID–19 augments—
13 (A) traditional contact tracing efforts, if
14 applicable; and
15 (B) statewide efforts to prevent, prepare
16 for, and respond to COVID–19; and
17 (2) include in such plan a description of the
18 agency’s efforts to ensure that the digital contact-
19 tracing technologies of the agency with respect to
20 COVID–19 are interoperable with the digital con-
21 tact-tracing technology and public health agency
22 databases of other jurisdictions with respect to
23 COVID–19; and
24 (3) ensure that data collected by the digital
25 contact-tracing technology of the agency—
•S 5027 IS
VerDate Sep 11 2014 19:58 Jan 01, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S5027.IS S5027
6
1 (A) is accessed and processed only by pub-
2 lic health authorities (or their designees); and
3 (B) is not shared with any person, or
4 accessed or used by any person, for any purpose
5 other than diagnosis, containment, treatment,
6 or reduction of, or research into, COVID–19.
7 (f) INDEPENDENT SECURITY ASSESSMENTS.—
8 (1) IN GENERAL.—As a condition on receipt of
9 a grant under this section, a State, Tribal, or terri-
10 torial public health agency shall—
11 (A) establish procedures for completing or
12 obtaining independent security assessments of
13 digital contact tracing infrastructure to ensure
14 that physical and network security is resilient
15 and secure; and
16 (B) develop a process to address the miti-
17 gation or remediation of the security
18 vulnerabilities discovered during such inde-
19 pendent security assessments.
20 (2) SOURCE CODE.—A State, Tribal, or terri-
21 torial public health agency should consider making
22 public the source code of the digital contact-tracing
23 technology used by the agency.
24 (g) APPLICATION.—To seek a grant under this sec-
25 tion, an eligible State, Tribal, or territorial public health
•S 5027 IS
VerDate Sep 11 2014 19:58 Jan 01, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S5027.IS S5027
7
1 agency shall submit an application in such form, in such
2 manner, and containing such information and assurances
3 as the Director may require.
4 (h) SECURING DIGITAL CONTACT-TRACING DATA.—
5 (1) IN GENERAL.—The provisions of the
6 HIPAA privacy and security law (as defined in sec-
7 tion 3009(a)(2) of the Public Health Service Act (42
8 U.S.C. 300jj–19(a)(2))) shall apply to a State, Trib-
9 al, or territorial public health agency receiving a
10 grant under subsection (a) with respect to individ-
11 ually identifiable health information (as defined in
12 section 1171(a)(6) of the Social Security Act (42
13 U.S.C. 1320d(a)(6))) received by, maintained on, or
14 transmitted through a contact tracing program de-
15 scribed in such subsection (a) in the same manner
16 as such provisions apply with respect to such infor-
17 mation and a covered entity (as defined in section
18 13400(3) of the HITECH Act (42 U.S.C.
19 17921(3))).
20 (2) BUSINESS ASSOCIATES.—
21 (A) IN GENERAL.—Any entity with a con-
22 tract in effect with an agency described in para-
23 graph (1) for the development, maintenance, or
24 operation of a program described in such para-
25 graph shall be deemed to be a business asso-
•S 5027 IS
VerDate Sep 11 2014 19:58 Jan 01, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S5027.IS S5027
8
1 ciate of such agency for purposes of subtitle D
2 of the HITECH Act (42 U.S.C. 17921 et seq.).
3 (B) REVISION OF SAMPLE AGREEMENT.—
4 Not later than 180 days after the date of the
5 enactment of this Act, the Secretary shall revise
6 the sample business associate agreement provi-
7 sions published on January 25, 2013, to take
8 account of the provisions of this subsection.
9 (C) EFFECTIVE DATE.—The provisions of
10 subparagraph (A) shall apply beginning on the
11 day after the Secretary revises the provisions
12 described in subparagraph (B).
13 (i) LIMITATION ON USE OF DATA.—Data generated
14 in connection with the operation of digital contact-tracing
15 technology funded pursuant to this section may not be
16 used for any punitive purpose, including law enforcement,
17 immigration enforcement, or criminal prosecution. Such
18 data and any information derived from it, whether in
19 whole or in part, may not be received as evidence in any
20 trial, hearing, or other proceeding in or before any court,
21 grand jury, department, officer, agency, regulatory body,
22 legislative committee, or other authority of the United
23 States, a State, or a political subdivision thereof.
•S 5027 IS
VerDate Sep 11 2014 19:58 Jan 01, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S5027.IS S5027
9
1 (j) REPORT TO CONGRESS.—Not later than 24
2 months after the date of enactment of this Act, the Comp-
3 troller General of the United States shall—
4 (1) evaluate the outcome of the grants awarded
5 under this section, including an assessment of the
6 impact of the implementation of digital contact trac-
7 ing programs funded through such grants on the
8 spread of COVID–19; and
9 (2) submit to the Congress a report on the re-
10 sults of such evaluation.
11 (k) DEFINITIONS.—In this section:
12 (1) AFFIRMATIVE EXPRESS CONSENT.—The
13 term ‘‘affirmative express consent’’ means an affirm-
14 ative act by an individual that clearly and conspicu-
15 ously communicates the individual’s authorization
16 for an act or practice, in response to a specific re-
17 quest that—
18 (A) is provided to the individual in a clear
19 and conspicuous disclosure that is separate
20 from other options or acceptance of general
21 terms;
22 (B) includes a description of each act or
23 practice for which the individual’s consent is
24 sought and—
•S 5027 IS
VerDate Sep 11 2014 19:58 Jan 01, 2021 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S5027.IS S5027
10
1 (i) is written clearly and unmistakably
2 stated; and
3 (ii) includes a prominent heading that
4 would enable a reasonable individual to
5 identify and understand the act or prac-
6 tice; and
7 (C) cannot be inferred from inaction.
8 (2) CONTACT-TRACING DATA.—The term ‘‘con-
9 tact-tracing data’’ means information linked or rea-
10 sonably linkable to a user or device, that—
11 (A) concerns the COVID–19 pandemic;
12 and
13 (B) is gathered, processed, or transferred
14 by digital contact-tracing technology.
15 (3) COVID–19 EMERGENCY DECLARATION.—
16 The term ‘‘COVID–19 emergency declaration’’ has
17 the meaning given to such term in section
18 1135(g)(1)(B) of the Social Security Act (42 U.S.C.
19 1320b–5).
20 (4) DE-IDENTIFY.—The term ‘‘de-identify’’
21 means to ensure that information cannot reasonably
22 identify, relate to, describe, be capable of being asso-
23 ciated with, or be linked, directly or indirectly, to a
24 particular individual.
25 (5) DESIGNEE.—The term ‘‘designee’’—
•S 5027 IS
VerDate Sep 11 2014 19:58 Jan 01, 2021 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S5027.IS S5027
11
1 (A) subject to subparagraph (B), means
2 any person or entity, other than a public health
3 agency, that collects, processes, or transfers
4 contact-tracing data in the course of performing
5 a service or function on behalf of, for the ben-
6 efit of, under instruction of, and under contrac-
7 tual agreement with a public health authority;
8 and
9 (B) excludes any Federal, State, Tribal,
10 territorial, or local law (including immigration
11 law) enforcement personnel or entity.
12 (6) DIGITAL CONTACT-TRACING TECH-
13 NOLOGY.—
14 (A) IN GENERAL.—The term ‘‘digital con-
15 tact-tracing technology’’ means a website, on-
16 line application, mobile application, mobile oper-
17 ating system feature, or smart device applica-
18 tion that is designed, in part or in full, for the
19 purpose of—
20 (i) determining that a contact incident
21 has occurred relating to the COVID–19
22 pandemic; and
23 (ii) taking consequent steps such as
24 reporting the incident to a public health
25 authority or user, or providing guidance or
•S 5027 IS
VerDate Sep 11 2014 19:58 Jan 01, 2021 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S5027.IS S5027
12
1 instructions to the user of the mobile de-
2 vice or the user’s household.
3 (B) LIMITATIONS.—Such term does not in-
4 clude any technology to assist individuals to
5 evaluate whether they are experiencing COVID–
6 19 symptoms to the extent the technology is not
7 used as described in subparagraph (A).
8 (7) DIRECTOR.—The term ‘‘Director’’ means
9 the Director of the Centers for Disease Control and
10 Prevention.
11 (8) MOBILE APPLICATION.—The term ‘‘mobile
12 application’’ means a software program that runs on
13 the operating system of a mobile device.
14 (9) MOBILE DEVICE.—The term ‘‘mobile de-
15 vice’’ means a smartphone, tablet computer, or simi-
16 lar portable computing device that transmits data
17 over a wireless connection.
18 (10) SOURCE CODE.—The term ‘‘source code’’
19 is the programming instruction for a computer pro-
20 gram in its original form and saved in a file.
21 (11) TRADITIONAL CONTACT TRACING.—The
22 term ‘‘traditional contact tracing’’ means contact
23 tracing by traditional means prior to contemporary
24 digital contact tracing.
•S 5027 IS
VerDate Sep 11 2014 19:58 Jan 01, 2021 Jkt 019200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S5027.IS S5027
13
1 (12) USER.—The term ‘‘user’’ means a member
2 of the public who utilizes the software or hardware
3 product.
4 (l) AUTHORIZATION OF APPROPRIATIONS.—To carry
5 out this section, there are authorized to be appropriated
6 $75,000,000, to remain available until expended.
Æ
•S 5027 IS
VerDate Sep 11 2014 19:58 Jan 01, 2021 Jkt 019200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6301 E:\BILLS\S5027.IS S5027
File and source
- File
- BILLS_bills-116s5027is_bills-116s5027is.pdf
- Size
- 247,746 bytes
- SHA-256
- c57fc0d812b19ee21672b7da858a924043ef8ea05156ceeae9810ebe15228652
- Original
- www.govinfo.gov