The Senate is drawing a HIPAA line around wellness data, and it runs through your database
The Health Information Privacy Reform Act cleared the Senate HELP Committee unanimously and would regulate wellness apps and wearables by what their data says, not what the company is.
On July 30 the Senate HELP Committee voted unanimously to send S. 3097, the Health Information Privacy Reform Act, to the full Senate. It is Senator Cassidy’s bill, and it would direct HHS, working with the FTC, to write HIPAA-style privacy, security, and breach notification rules for companies HIPAA has never reached: fitness trackers, sleep and cycle apps, wearable platforms, and most of the consumer wellness market. A unanimous committee vote in an election year does not make a law, and the floor calendar between now and November is short. But the bill tells you where the federal line is going to be drawn, and the answer is inside your schema.
The most important design choice in the bill is that it triggers on data, not on the type of company. HIPAA asks whether you are a provider, plan, or clearinghouse. S. 3097 asks whether a record identifies a person and relates to their physical or mental health. Under that test, resting heart rate, sleep stages, a mood log, and a supplement regimen all count, and the entity holding them is a “regulated entity” whether it thinks of itself as a health company or not. Washington’s My Health My Data Act already works this way, and the FTC’s recent health data cases have too. The federal bill would make the content-based test the national floor while leaving stricter state laws in place.
Operationally, three provisions would change how a wellness product is built. First, anyone offering technology that generates “wellness data,” which the bill illustrates with step counts, vital signs, and regimen compliance, would have to tell the user up front that the data is not HIPAA-protected and offer a chance to opt out before generation starts. That is an onboarding screen and a per-user flag, not a privacy policy paragraph. Second, the bill pushes regulated entities toward HIPAA’s permitted-uses model, where data is used for the service the user asked for and anything else, including advertising and sale, needs a separate, revocable authorization. If your growth stack depends on health signals flowing to ad platforms, that is the part to read twice. Third, HHS would issue guidance on applying the minimum necessary standard to data used to train or operate AI models, and would set new national de-identification standards. The committee-approved text reportedly does not let you reach de-identified status through HIPAA’s safe harbor method alone, which is the method most engineering teams have implemented.
Enforcement would be HHS and the FTC using HIPAA’s tiered penalty structure. There is no private right of action in the bill, which is a meaningful difference from Washington’s statute. There is also a flat prohibition on selling or handing consumer health data to any government entity without a warrant, subpoena, or court order.
The useful thing to do this quarter, whether or not this bill moves, is a field-level health data map. Have engineering pull every column, event, and third-party payload that describes a user’s body, mind, or health behavior, and tag each one with where it goes: internal analytics, ad platforms, model training, data partners. Then mark which of those destinations the user actually asked for. That single document is what you would need under S. 3097, what you already need under Washington and the newer state health privacy laws, and what the FTC will ask for the day it reads your homepage. Building it now means the bill’s arrival, in this Congress or the next, is a configuration change instead of a rewrite.