Contact Congress about S. 3097: Health Information Privacy Reform Act

This bill extends HIPAA-like privacy protections to health data collected by apps, wearables, and other non-HIPAA companies. People would get new rights over their data and must receive clear warnings when their health information leaves HIPAA's protection. HHS must also write guidance on AI use of health data and set national de-identification standards.

Modern Action explains legislation in plain English, helps you choose whether to support, oppose, or ask for changes, and drafts a message tied to the bill, your stance, and the elected officials who can act on it.

Health Information Privacy Reform Act is a Senate bill in committee. The latest recorded action: Read twice and referred to the Committee on Health, Education, Labor, and Pensions.

Latest action on S. 3097: Read twice and referred to the Committee on Health, Education, Labor, and Pensions.

Who this affects: This bill touches nearly everyone who uses a health or wellness app, wearable device, or digital health platform, and it places new obligations on a broad range of technology companies. Traditional HIPAA-covered providers and health plans are affected more narrowly, mainly through the changes to the patient right-of-access process.

Why this matters: Most Americans now generate health-related data outside of traditional medical settings — through fitness trackers, period-tracking apps, mental health platforms, and diet tools. HIPAA does not cover these products, leaving a major gap that companies have exploited to collect, sell, and share sensitive health information with few restrictions. This bill is an attempt to close that gap using a HIPAA-style framework people already understand, while also updating rules for AI use of health data and setting clearer standards for de-identification.

Key provisions in S. 3097

• Defines 'applicable health information' to include identifiable health-related data even when it does not come from traditional HIPAA-covered entities.
• Directs HHS, in consultation with the FTC, to issue new privacy, security, and breach notification regulations for regulated entities and their service providers handling applicable health information.
• Requires that new protections be at least as strong as, and where possible harmonized with, existing HIPAA and HITECH privacy, security, and breach notification rules.
• Grants HHS enforcement power and applies the existing HIPAA civil penalty framework (45 C.F.R. part 160, subpart D) to violations by regulated entities and service providers.
• Extends certain HITECH privacy and security practice provisions (42 U.S.C. 17941) to regulated entities and service providers for applicable health information.

How Modern Action helps you take action on S. 3097

You do not have to start with a blank letter. Modern Action turns the bill, your position, and the relevant congressional context into a message you can edit and send. The goal is to make contacting Congress clear, specific, and useful without forcing you to parse bill text or figure out the right office on your own.

Questions people ask about S. 3097

What is S. 3097?

This bill extends HIPAA-like privacy protections to health data collected by apps, wearables, and other non-HIPAA companies. People would get new rights over their data and must receive clear warnings when their health information leaves HIPAA's protection. HHS must also write guidance on AI use of health data and set national de-identification standards.

How do I support or oppose S. 3097?

Choose support, oppose, or ask for changes on Modern Action. The action flow drafts the message for you and keeps the wording tied to this bill.

Who should I contact about S. 3097?

Modern Action uses your location to route the action to the congressional offices relevant to the bill and your representation.

Can Modern Action explain S. 3097 before I act?

Yes. Modern Action gives you a plain-English summary, current status, and action context before you send anything.