As federal lawmakers consider further consumer data privacy protections, industry stakeholders want more consideration given to the nuances particular to health-care information.
Sen. Roger Wicker, R-Mississippi, chairman of the Commerce Committee, earlier this month issued a draft of the United States Consumer Data Privacy Act of 2019 (CDAP), which would supersede the mixture of state privacy laws in place.
“Given the 2018 implementation of the European Union’s General Data Protection Regulation, the passage of the California Consumer Privacy Act and near-daily reports of data breaches and misuse, it is clear that Congress needs to act now to provide stronger and more meaningful data protections to consumers and address the privacy risks that threaten the prosperity of the nation’s digital economy,” Wicker said in a statement.
CDAP bears some resemblance to the 1996 Health Insurance Portability and Accountability Act, according to an article in the HIPAA Journal.
“Similar to HIPAA, CDAP also includes a ‘minimum necessary’ provision, which requires companies to restrict the collection of data to the minimum necessary amount to achieve the purpose for which information is being collected," the Journal wrote. "CDAP would also require companies to implement security measures to protect personal data, adopt security best practices, and practice data minimization.”
But there are questions about how CDAP could hamper modern medical innovations.
Writing for the Privacy Advisor, Kirk Nahra, a data security law expert in the health care and insurance industries, asks, “How can we begin a dialogue on how these principles should be applied to protect consumers while at the same time permit the critical health care industry to move forward effectively and efficiently?”
Data hold tremendous potential for clinicians who can access it to develop new medical treatments against disease, University of Virginia law professor Margaret Foster Riley told The Verge. “Privacy is very, very important, but if we focus only on the idea of control for the individual, we will hurt research,” Riley said.
The proposed legislation was discussed at a Senate Commerce Committee hearing in Washington earlier this month.