H.R. 778, Secure Data and Privacy for Contact Tracing Act of 2021
Summary
H.R. 778, the Secure Data and Privacy for Contact Tracing Act of 2021, introduced in the House of Representatives on February 3, 2021 by Ms. Speier and other members. The bill's stated purpose is to authorize the Director of the Centers for Disease Control and Prevention to award grants to eligible State, Tribal, and territorial public health agencies to develop and administer a program for digital contact tracing for COVID–19. Funds may be used for development, maintenance, or staffing of digital contact tracing programs and associated outreach. The bill authorizes $75,000,000, to remain available until expended.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
- Issuer
- Congressional materials
- Document type
- Bills Bills 117Hr778Ih Bills 117Hr778Ih
- Case
- Bills Bills 117Hr778Ih Bills 117Hr778Ih
Cite this document
“H.R. 778, Secure Data and Privacy for Contact Tracing Act of 2021.”
Original at www.govinfo.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/bills-bills-117hr778ih-bills-117hr778ih/
, SHA-256 2c88e6b1b49b513d83e5c8f69eb171e0fb8a10d60f20e06a33cfc6cf779d9eee.Full text
I
117TH CONGRESS
1ST SESSION
H. R. 778
To authorize the Director of the Centers for Disease Control and Prevention
to award grants to eligible State, Tribal, and territorial public health
agencies to develop and administer a program for digital contact tracing
for COVID–19, and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
FEBRUARY 3, 2021
Ms. SPEIER (for herself, Ms. DEGETTE, Mrs. DINGELL, Mr. CARSON, Mr.
JONES, Mr. LYNCH, Mr. RASKIN, and Mr. TAKANO) introduced the fol-
lowing bill; which was referred to the Committee on Energy and Com-
merce
A BILL
To authorize the Director of the Centers for Disease Control
and Prevention to award grants to eligible State, Tribal,
and territorial public health agencies to develop and ad-
minister a program for digital contact tracing for
COVID–19, and for other purposes.
1 Be it enacted by the Senate and House of Representa-
2 tives of the United States of America in Congress assembled,
3 SECTION 1. SHORT TITLE.
4 This Act may be cited as the ‘‘Secure Data and Pri-
pamtmann on DSKBC07HB2PROD with BILLS
5 vacy for Contact Tracing Act of 2021’’.
VerDate Sep 11 2014 20:40 Feb 23, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H778.IH H778
2
1 SEC. 2. GRANT PROGRAM FOR DIGITAL CONTACT TRACING
2 FOR COVID–19.
3 (a) IN GENERAL.—The Director of the Centers for
4 Disease Control and Prevention shall award grants to eli-
5 gible State, Tribal, and territorial public health agencies
6 to—
7 (1) establish a contact tracing program that im-
8 plements traditional contact tracing protocols with
9 the assistance of digital contact-tracing technology
10 to track and prevent the spread of COVID–19;
11 (2) incorporate digital contact-tracing tech-
12 nology into a contact tracing program that imple-
13 ments traditional contact tracing protocols to track
14 and prevent the spread of COVID–19; and
15 (3) expand or maintain an existing program as
16 described in paragraph (1).
17 (b) USE OF FUNDS.—
18 (1) IN GENERAL.—Funds received through a
19 grant under this section may be used for—
20 (A) the development, maintenance, or
21 staffing of digital contact tracing programs;
22 (B) associated outreach and marketing; or
23 (C) other activities identified by the State,
24 Tribal, or territorial public health agency re-
pamtmann on DSKBC07HB2PROD with BILLS
25 ceiving the grant as advancing the effectiveness
•HR 778 IH
VerDate Sep 11 2014 20:40 Feb 23, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H778.IH H778
3
1 and reach of digital contact-tracing tech-
2 nologies.
3 (2) EDUCATION AND OUTREACH.—Of the funds
4 received by a State, Tribal, or territorial public
5 health agency through a grant under this section,
6 the agency may use not more than 10 percent of
7 such funds to integrate education and outreach re-
8 lated to vaccines for COVID–19 into digital contact-
9 tracing programs.
10 (c) FUNDING DISQUALIFICATION.—If a State, Trib-
11 al, or territorial public health agency develops or procures
12 any digital contact-tracing technology with respect to
13 COVID–19 that does not meet each of the requirements
14 listed in subsection (d), such State, Tribal, or territorial
15 public health agency shall be ineligible to receive or con-
16 tinue to receive—
17 (1) any funds through a grant under this sec-
18 tion; and
19 (2) any other Federal funds, including under
20 the CARES Act (Public Law 116–136), for any dig-
21 ital contact-tracing technology with respect to
22 COVID–19.
23 (d) DIGITAL CONTACT-TRACING REQUIREMENTS.—
pamtmann on DSKBC07HB2PROD with BILLS
24 A State, Tribal, or territorial public health agency may
25 use a grant under this section for digital contact-tracing
•HR 778 IH
VerDate Sep 11 2014 20:40 Feb 23, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H778.IH H778
4
1 technology, as described in subsections (a) and (b), only
2 if the technology meets each of the following requirements:
3 (1) The technology shall be voluntary for the
4 user and provide to the user complete and clear in-
5 formation on the intended use and processing of
6 data collected by the technology. To be voluntary for
7 the user, the technology shall meet requirements in-
8 cluding each of the following:
9 (A) Use of the technology and of contact-
10 tracing data collected using the technology shall
11 be predicated on the user’s affirmative express
12 consent.
13 (B) Use of the technology shall not be a
14 condition for the reception of government bene-
15 fits.
16 (C) Use of the technology shall not be
17 made a condition of employment or employment
18 status.
19 (2) The technology shall limit the collection of
20 data by the technology to only the data that is nec-
21 essary to meet contact tracing objectives, includ-
22 ing—
23 (A) the status of any person as an infected
pamtmann on DSKBC07HB2PROD with BILLS
24 or potentially infected person; and
•HR 778 IH
VerDate Sep 11 2014 20:40 Feb 23, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H778.IH H778
5
1 (B) the proximity of a person to someone
2 who is symptomatic or has tested positive.
3 (3) The technology—
4 (A) shall delete or de-identify any contact-
5 tracing data that is individually identifiable in-
6 formation not later than the date that is 30
7 days after the end of the COVID–19 emergency
8 declaration; and
9 (B) shall include notifications to prompt
10 users to disable or completely remove any dig-
11 ital contact-tracing technology where practical.
12 (4) The technology shall have robust contact
13 detection specifications, including for distance and
14 time, that allow for detection consistent with guid-
15 ance of the Centers for Disease Control and Preven-
16 tion on COVID–19.
17 (5) The technology shall ensure that the storing
18 of proximity and any contact-tracing data is
19 encrypted to the maximum extent possible.
20 (e) PLAN FOR INTEROPERABILITY.—As a condition
21 on receipt of a grant under this section, a State, Tribal,
22 or territorial public health agency shall—
23 (1) develop and make publicly available a plan
pamtmann on DSKBC07HB2PROD with BILLS
24 for how the digital contact-tracing technology of the
25 agency with respect to COVID–19 augments—
•HR 778 IH
VerDate Sep 11 2014 20:40 Feb 23, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H778.IH H778
6
1 (A) traditional contact tracing efforts, if
2 applicable; and
3 (B) statewide efforts to prevent, prepare
4 for, and respond to COVID–19; and
5 (2) include in such plan a description of the
6 agency’s efforts to ensure that the digital contact-
7 tracing technologies of the agency with respect to
8 COVID–19 are interoperable with the digital con-
9 tact-tracing technology and public health agency
10 databases of other jurisdictions with respect to
11 COVID–19; and
12 (3) ensure that data collected by the digital
13 contact-tracing technology of the agency—
14 (A) is accessed and processed only by pub-
15 lic health authorities (or their designees); and
16 (B) is not shared with any person, or
17 accessed or used by any person, for any purpose
18 other than diagnosis, containment, treatment,
19 or reduction of, or research into, COVID–19.
20 (f) INDEPENDENT SECURITY ASSESSMENTS.—
21 (1) IN GENERAL.—As a condition on receipt of
22 a grant under this section, a State, Tribal, or terri-
23 torial public health agency shall—
pamtmann on DSKBC07HB2PROD with BILLS
24 (A) establish procedures for completing or
25 obtaining independent security assessments of
•HR 778 IH
VerDate Sep 11 2014 20:40 Feb 23, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H778.IH H778
7
1 digital contact tracing infrastructure to ensure
2 that physical and network security is resilient
3 and secure; and
4 (B) develop a process to address the miti-
5 gation or remediation of the security
6 vulnerabilities discovered during such inde-
7 pendent security assessments.
8 (2) SOURCE CODE.—A State, Tribal, or terri-
9 torial public health agency should consider making
10 public the source code of the digital contact-tracing
11 technology used by the agency.
12 (g) APPLICATION.—To seek a grant under this sec-
13 tion, an eligible State, Tribal, or territorial public health
14 agency shall submit an application in such form, in such
15 manner, and containing such information and assurances
16 as the Director may require.
17 (h) SECURING DIGITAL CONTACT-TRACING DATA.—
18 (1) IN GENERAL.—The provisions of the
19 HIPAA privacy and security law (as defined in sec-
20 tion 3009(a)(2) of the Public Health Service Act (42
21 U.S.C. 300jj–19(a)(2))) shall apply to a State, Trib-
22 al, or territorial public health agency receiving a
23 grant under subsection (a) with respect to individ-
pamtmann on DSKBC07HB2PROD with BILLS
24 ually identifiable health information (as defined in
25 section 1171(a)(6) of the Social Security Act (42
•HR 778 IH
VerDate Sep 11 2014 20:40 Feb 23, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H778.IH H778
8
1 U.S.C. 1320d(a)(6))) received by, maintained on, or
2 transmitted through a contact tracing program de-
3 scribed in such subsection (a) in the same manner
4 as such provisions apply with respect to such infor-
5 mation and a covered entity (as defined in section
6 13400(3) of the HITECH Act (42 U.S.C.
7 17921(3))).
8 (2) BUSINESS ASSOCIATES.—
9 (A) IN GENERAL.—Any entity with a con-
10 tract in effect with an agency described in para-
11 graph (1) for the development, maintenance, or
12 operation of a program described in such para-
13 graph shall be deemed to be a business asso-
14 ciate of such agency for purposes of subtitle D
15 of the HITECH Act (42 U.S.C. 17921 et seq.).
16 (B) REVISION OF SAMPLE AGREEMENT.—
17 Not later than 180 days after the date of the
18 enactment of this Act, the Secretary of Health
19 and Human Services shall revise the sample
20 business associate agreement provisions pub-
21 lished on January 25, 2013, to take account of
22 the provisions of this subsection.
23 (C) EFFECTIVE DATE.—The provisions of
pamtmann on DSKBC07HB2PROD with BILLS
24 subparagraph (A) shall apply beginning on the
25 day after the Secretary of Health and Human
•HR 778 IH
VerDate Sep 11 2014 20:40 Feb 23, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H778.IH H778
9
1 Services revises the provisions described in sub-
2 paragraph (B).
3 (i) LIMITATION ON USE OF DATA.—Data generated
4 in connection with the operation of digital contact-tracing
5 technology funded pursuant to this section may not be
6 used for any punitive purpose, including law enforcement,
7 immigration enforcement, or criminal prosecution. Such
8 data and any information derived from it, whether in
9 whole or in part, may not be received as evidence in any
10 trial, hearing, or other proceeding in or before any court,
11 grand jury, department, officer, agency, regulatory body,
12 legislative committee, or other authority of the United
13 States, a State, or a political subdivision thereof.
14 (j) REPORT TO CONGRESS.—Not later than 24
15 months after the date of enactment of this Act, the Comp-
16 troller General of the United States shall—
17 (1) evaluate the outcome of the grants awarded
18 under this section, including an assessment of the
19 impact of the implementation of digital contact trac-
20 ing programs funded through such grants on the
21 spread of COVID–19; and
22 (2) submit to the Congress a report on the re-
23 sults of such evaluation.
pamtmann on DSKBC07HB2PROD with BILLS
24 (k) DEFINITIONS.—In this section:
•HR 778 IH
VerDate Sep 11 2014 20:40 Feb 23, 2021 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H778.IH H778
10
1 (1) AFFIRMATIVE EXPRESS CONSENT.—The
2 term ‘‘affirmative express consent’’ means an affirm-
3 ative act by an individual that clearly and conspicu-
4 ously communicates the individual’s authorization
5 for an act or practice, in response to a specific re-
6 quest that—
7 (A) is provided to the individual in a clear
8 and conspicuous disclosure that is separate
9 from other options or acceptance of general
10 terms;
11 (B) includes a description of each act or
12 practice for which the individual’s consent is
13 sought and—
14 (i) is written clearly and unmistakably
15 stated; and
16 (ii) includes a prominent heading that
17 would enable a reasonable individual to
18 identify and understand the act or prac-
19 tice; and
20 (C) cannot be inferred from inaction.
21 (2) CONTACT-TRACING DATA.—The term ‘‘con-
22 tact-tracing data’’ means information linked or rea-
23 sonably linkable to a user or device, that—
pamtmann on DSKBC07HB2PROD with BILLS
24 (A) concerns the COVID–19 pandemic;
25 and
•HR 778 IH
VerDate Sep 11 2014 20:40 Feb 23, 2021 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H778.IH H778
11
1 (B) is gathered, processed, or transferred
2 by digital contact-tracing technology.
3 (3) COVID–19 EMERGENCY DECLARATION.—
4 The term ‘‘COVID–19 emergency declaration’’ has
5 the meaning given to such term in section
6 1135(g)(1)(B) of the Social Security Act (42 U.S.C.
7 1320b–5).
8 (4) DE-IDENTIFY.—The term ‘‘de-identify’’
9 means to ensure that information cannot reasonably
10 identify, relate to, describe, be capable of being asso-
11 ciated with, or be linked, directly or indirectly, to a
12 particular individual.
13 (5) DESIGNEE.—The term ‘‘designee’’—
14 (A) subject to subparagraph (B), means
15 any person or entity, other than a public health
16 agency, that collects, processes, or transfers
17 contact-tracing data in the course of performing
18 a service or function on behalf of, for the ben-
19 efit of, under instruction of, and under contrac-
20 tual agreement with a public health authority;
21 and
22 (B) excludes any Federal, State, Tribal,
23 territorial, or local law (including immigration
pamtmann on DSKBC07HB2PROD with BILLS
24 law) enforcement personnel or entity.
•HR 778 IH
VerDate Sep 11 2014 20:40 Feb 23, 2021 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H778.IH H778
12
1 (6) DIGITAL CONTACT-TRACING TECH-
2 NOLOGY.—
3 (A) IN GENERAL.—The term ‘‘digital con-
4 tact-tracing technology’’ means a website, on-
5 line application, mobile application, mobile oper-
6 ating system feature, or smart device applica-
7 tion that is designed, in part or in full, for the
8 purpose of—
9 (i) determining that a contact incident
10 has occurred relating to the COVID–19
11 pandemic; and
12 (ii) taking consequent steps such as
13 reporting the incident to a public health
14 authority or user, or providing guidance or
15 instructions to the user of the mobile de-
16 vice or the user’s household.
17 (B) LIMITATIONS.—Such term does not in-
18 clude any technology to assist individuals to
19 evaluate whether they are experiencing COVID–
20 19 symptoms to the extent the technology is not
21 used as described in subparagraph (A).
22 (7) DIRECTOR.—The term ‘‘Director’’ means
23 the Director of the Centers for Disease Control and
pamtmann on DSKBC07HB2PROD with BILLS
24 Prevention.
•HR 778 IH
VerDate Sep 11 2014 20:40 Feb 23, 2021 Jkt 019200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H778.IH H778
13
1 (8) MOBILE APPLICATION.—The term ‘‘mobile
2 application’’ means a software program that runs on
3 the operating system of a mobile device.
4 (9) MOBILE DEVICE.—The term ‘‘mobile de-
5 vice’’ means a smartphone, tablet computer, or simi-
6 lar portable computing device that transmits data
7 over a wireless connection.
8 (10) SOURCE CODE.—The term ‘‘source code’’
9 is the programming instruction for a computer pro-
10 gram in its original form and saved in a file.
11 (11) TRADITIONAL CONTACT TRACING.—The
12 term ‘‘traditional contact tracing’’ means contact
13 tracing by traditional means prior to contemporary
14 digital contact tracing.
15 (12) USER.—The term ‘‘user’’ means a member
16 of the public who utilizes the software or hardware
17 product.
18 (l) AUTHORIZATION OF APPROPRIATIONS.—To carry
19 out this section, there are authorized to be appropriated
20 $75,000,000, to remain available until expended.
Æ
pamtmann on DSKBC07HB2PROD with BILLS
•HR 778 IH
VerDate Sep 11 2014 20:40 Feb 23, 2021 Jkt 019200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6301 E:\BILLS\H778.IH H778
File and source
- File
- BILLS_bills-117hr778ih_bills-117hr778ih.pdf
- Size
- 248,921 bytes
- SHA-256
- 2c88e6b1b49b513d83e5c8f69eb171e0fb8a10d60f20e06a33cfc6cf779d9eee
- Original
- www.govinfo.gov