Search

By HPN Staff
Key Points
  • Sen. Bill Cassidy introduced the Health Information Privacy Reform Act, which would extend HIPAA-level privacy and security rules to wearable health devices such as smartwatches, fitness trackers, and medical monitoring tools.
  • Wearable devices currently fall outside HIPAA protections, leaving health-related data stored in the cloud vulnerable to misuse, sale to third parties, and inconsistent privacy practices.
  • The bill emerges amid soaring wearable adoption, boosted by HHS Secretary Robert F. Kennedy Jr.’s MAHA initiative and an NIH study that flagged major privacy risks across 17 popular devices.

With the popularity of wearable health devices growing, so too are the concerns about ensuring the privacy of the data that those trackers gather.

Sen. Bill Cassidy (R-LA) has introduced a bill designed to expand data privacy protections to include gadgets such as fitness trackers, smart watches, and medical and safety devices.

Currently, these devices that collect or monitor health-related data, such as heart rate, sleep quality and movement, are not covered under the Health Insurance Portability and Accountability Act (HIPAA), which sets federal standards for safeguarding patient data and privacy.  

Cassidy’s bill, dubbed The Health Information Privacy Reform Act (HIPRA) would require the Department of Health and Human Services (HHS) and the Federal Trade Commission (FTC) to promulgate rules to set privacy, security, and breach notification standards for such devices in line with the existing HIPAA standards. 

Why it matters

Cassidy, a medical doctor who serves as Chair of the Senate Health, Education, Labor and Pensions Committee, said in a statement, “Smartwatches and health apps change the way people manage their health. They’re helpful tools, but present new privacy concerns that didn’t exist when it was just a patient and a doctor in an exam room.” 

He also said that HIPAA was “failing to keep up with consumer health products that connect individuals to health tools outside of the doctor’s office.”

The move comes amid rising consumer demand for wearable health devices and their embrace by the “Make America Healthy Again” (MAHA) movement led by HHS Secretary Robert F. Kennedy Jr. 

Earlier this year, Kennedy touted the use of wearables, telling the House Energy and Commerce Health Subcommittee in June that “my vision is every American is wearing a wearable within four years.” 

He also said on X that “Wearables put the power of health back in the hands of the American people. We’re launching one of the largest HHS campaigns in history to encourage their use…”

Their use, however, has raised privacy concerns, since the data collected is stored on the cloud, and potentially susceptible to misuse, such as sale to third parties.  

The bigger picture

Recently, the National Institute of Health conducted a study of 17 wearable devices and gave them a privacy risk score.

The devices were rated in the following categories:

  • Transparency
  • Data collection purposes
  • Data minimization
  • User control and rights
  • Third-party data sharing
  • Data security
  • Breach notification

The study found the companies with the highest “high risk” ratings were Xiaomi, Wyze and Huawei, while Apple, Google and Polar had the lowest.

SUGGESTED STORIES

Plastics are everywhere — should you be concerned?

You will almost certainly eat or drink plastic this week. While the U.S. Food and Drug Administration has concluded that the current scientific evidence “does not demonstrate that levels of microplastics or nanoplastics detected in food pose a risk to human health,” a wide range of

Read more

Subscribe to our newsletter: