The Health Information Privacy Reform Act (HIPRA) is gaining momentum in Washington, with a bipartisan proposal aimed at closing one of the biggest gaps in U.S. health-data privacy: information collected by companies that are not covered by traditional HIPAA rules.
The legislation, introduced by Sen. Bill Cassidy, M.D. (R-La.), advanced through the Senate Health, Education, Labor, and Pensions (HELP) Committee in a unanimous 22-0 vote on July 30, 2026. It now moves toward consideration by the full Senate. HIPRA is not yet law, but its progress is significant because it could extend HIPAA-like protections to consumer health information collected through health apps, wearable devices and other technologies.
Why HIPRA Is Getting Attention
HIPAA protects health information handled by covered healthcare providers, health plans, healthcare clearinghouses and their business associates. But the rules generally do not apply simply because information is about a person’s health.
That distinction has become increasingly important as Americans use smartwatches, fitness trackers, fertility apps, wellness platforms and telehealth services. A blood-pressure reading entered into a physician’s medical record can be protected by HIPAA, while the same information recorded in a consumer wellness application may fall outside HIPAA’s protections.
HIPRA attempts to change that model by focusing more closely on the nature of the information, rather than simply the identity of the organization collecting it.
What Would HIPRA Do?
The amended legislation would direct the Department of Health and Human Services, in consultation with the Federal Trade Commission, to establish privacy, security and breach-notification standards for applicable health information handled by entities outside traditional HIPAA coverage.
The proposed framework includes restrictions on uses and disclosures, individual rights, security safeguards and civil penalties modeled on HIPAA. It would also give consumers stronger control over their information, including a proposed right to request deletion.
The legislation also addresses areas that have become increasingly important in the digital-health economy, including data minimization, health-related geolocation, data brokers, de-identification and artificial intelligence.
That could make HIPRA much broader than a simple extension of HIPAA.
Health Apps and Wearables Are at the Center
The biggest potential impact could be on consumer technology companies.
Smartwatches and fitness trackers can continuously generate information about heart rate, activity, sleep and other physiological characteristics. Health and wellness applications can collect symptoms, weight, reproductive information, medication-related details and other sensitive data.
With wearable technology now widely used in the United States, the volume of information being generated outside hospitals and physician offices is enormous. The HIPAA Guide notes that around 40% of Americans have a wearable device, illustrating how far consumer-generated health data has moved into everyday life.
The concern is not simply that companies collect this information. It is what happens afterward.
Data can move through cloud providers, analytics platforms, advertising technology, data warehouses and AI systems. HIPRA could make organizations more accountable for those downstream uses.
Advertising Is Already a Major Privacy Battleground
Recent regulatory activity shows why this issue is moving beyond theory.
In July 2026, the FTC, along with authorities in Utah and California, sued Hims & Hers Health, alleging that the telehealth company shared sensitive health information with advertising platforms despite privacy representations made to consumers. Hims & Hers has disputed the allegations and emphasized its privacy practices.
The case is important because it demonstrates that regulators are already examining how health companies interact with advertising technology.
Earlier FTC actions involving companies including GoodRx, BetterHelp and Flo Health similarly demonstrated the risks associated with using or disclosing sensitive health information for advertising and other secondary purposes.
HIPRA would arrive in an environment where regulators are already asking whether consumers genuinely understand how health-related information is being used.
Security Risks Are Growing Too
Privacy is only half of the problem.
In August 2026, healthcare technology company CareCloud confirmed that a breach had affected more than 3.75 million people, after attackers accessed data stored in an Amazon Web Services environment. The incident demonstrates the enormous consequences that can follow when large volumes of health information are concentrated in cloud systems.
A stronger federal framework would therefore not only restrict how health information can be used but also place greater emphasis on protecting it from unauthorized access.
For companies collecting consumer health data, cybersecurity and privacy are becoming increasingly inseparable.
HIPRA and Artificial Intelligence
Artificial intelligence adds another layer to the debate.
Health organizations and technology companies increasingly use AI for medical research, clinical support, documentation, analytics and personalized services. Consumer health platforms can also use machine-learning systems to analyze large quantities of physiological and behavioral information.
HIPRA’s amended framework would require HHS to address how the minimum-necessary standard should apply when health information is used to train, validate and operate AI and machine-learning models.
That could force companies to reconsider a common assumption in AI development: that collecting as much data as possible is always beneficial.
If HIPRA becomes law, organizations may increasingly need to demonstrate why particular health information is necessary for a particular AI purpose.
Geolocation Could Become a Health-Privacy Issue
Another notable feature of HIPRA is its attention to location information.
A location coordinate may not appear to be medical information on its own. But repeated visits to a cancer center, fertility clinic, mental-health facility or other healthcare provider can reveal extremely sensitive information.
The amended proposal would provide protections for certain precise geolocation information that could reasonably indicate an attempt to seek or obtain healthcare.
This reflects a broader trend in privacy regulation: information does not necessarily have to contain a diagnosis to reveal something highly sensitive about a person.
HIPRA Could Increase Pressure on Data Brokers
Data brokers may also face increased scrutiny.
Health-related information can become substantially more revealing when combined with location, purchasing behavior, demographics, online activity and other datasets.
HIPRA’s provisions addressing certain transfers and sales of applicable health information could therefore have implications beyond health apps and telehealth companies.
Businesses that obtain consumer information from multiple sources may need to determine whether seemingly unrelated datasets can collectively reveal health information.
What Companies Should Be Doing Now
HIPRA is not currently enforceable, so businesses should not claim to be “HIPRA compliant.” However, organizations collecting consumer health information can already take practical steps that would make future compliance easier.
| Area | Recommended action |
| Data inventory | Identify all health-related information collected |
| Data mapping | Document where information is stored and shared |
| Third parties | Review analytics, advertising and cloud providers |
| Consent | Check whether consumers understand data uses |
| Retention | Establish reasonable deletion and retention periods |
| Security | Review access controls, encryption and incident response |
| AI | Identify health data used in training or AI systems |
| Geolocation | Determine whether location can reveal healthcare activity |
One of the most important steps is reviewing third-party tracking technologies.
A company may believe it is protecting health information while its website or mobile application automatically sends information to analytics or advertising providers. Privacy policies also need to accurately reflect what the technology actually does.
HIPRA vs. Traditional HIPAA
HIPRA would not replace HIPAA. Instead, it is intended to address information that can fall outside HIPAA because it is collected by consumer-facing organizations.
| Issue | HIPAA | Proposed HIPRA |
| Hospitals and doctors | Covered | Covered by existing HIPAA framework |
| Health insurers | Covered | Existing HIPAA framework remains |
| Health apps | Often outside HIPAA | Potentially covered |
| Wearables | Often outside HIPAA | Potentially covered |
| Consumer deletion rights | Limited under HIPAA | Expanded rights proposed |
| Health-related geolocation | Depends on circumstances | Specific protections proposed |
| AI health-data use | Existing HIPAA rules where applicable | Additional federal requirements proposed |
State Laws Are Adding More Pressure
HIPRA is also arriving as states continue to develop their own consumer health privacy rules.
Washington’s My Health My Data Act, for example, was designed specifically to protect consumer health data outside traditional HIPAA coverage. California and other states have also developed broader privacy frameworks affecting sensitive personal information.
This means companies operating nationally may eventually have to manage several overlapping regimes rather than relying on one federal standard.
For businesses, the challenge could become less about identifying one privacy law and more about building a data-governance system capable of satisfying multiple requirements.
What Happens Next?
The Senate HELP Committee’s 22-0 vote is a major milestone, but HIPRA still has a long legislative path ahead.
The full Senate would need to consider the bill. If it passes, the legislation would then move to the House, where further changes could occur. It would ultimately need to pass both chambers in an agreed form before reaching the President.
Even if enacted, HHS rulemaking would be critical because many practical details would need to be defined through regulations.
For now, companies should treat HIPRA as a regulatory direction rather than an immediate compliance deadline.
Frequently Asked Questions
Is HIPRA law yet?
No. It has advanced through the Senate HELP Committee but still needs to complete the congressional process.
Who introduced HIPRA?
Sen. Bill Cassidy, M.D. (R-La.), introduced the legislation, with bipartisan support including Sen. Maggie Hassan (D-N.H.).
Who could be affected?
Consumer health apps, wearable platforms and other organizations handling health information outside traditional HIPAA coverage could potentially be affected.
Would HIPRA replace HIPAA?
No. The proposal is intended to address gaps in the existing HIPAA framework rather than eliminate HIPAA.
Could HIPRA affect AI companies?
Yes. The amended proposal specifically addresses the use of health information in AI and machine-learning systems.
Could companies be required to delete consumer health data?
The legislation proposes a consumer right to request deletion, subject to applicable requirements and exceptions.
Should businesses prepare now?
They cannot yet be required to comply with HIPRA, but reviewing data collection, retention, third-party sharing, security and consent practices now could reduce future compliance risk.
The Bigger Picture
HIPRA reflects a fundamental change in the way Americans generate health information.
Health data is no longer created only when someone visits a doctor. It can be generated continuously by a watch, phone, application, connected device or online healthcare platform.
That creates a difficult regulatory question: Should the same sensitive information receive dramatically different privacy protections simply because it was collected by a technology company rather than a hospital?
HIPRA’s answer is increasingly clear: lawmakers believe the current system needs to change.
The legislation is not law yet, and its final form could still change. But its unanimous committee advancement, combined with recent FTC actions and large healthcare data breaches, shows that consumer health-data privacy is becoming a much larger regulatory issue.
For digital-health companies, the safest strategy may be to start treating consumer health information as highly sensitive data todayeven when existing law does not yet require them to do so.
