The "Health Information Privacy Reform Act" aims to significantly enhance protections for health information by extending privacy, security, and breach notification standards to a wider array of entities. It directs the Secretary of Health and Human Services, in consultation with the Federal Trade Commission, to promulgate regulations for the processing of "applicable health information" by "regulated entities" and their service providers. These new standards are intended to be at least commensurate with, and where feasible, harmonize with, existing HIPAA privacy, security, and breach notification rules.

The regulations will encompass comprehensive privacy requirements, including permitted and prohibited uses and disclosures of health information, conditions for uses without authorization (e.g., public health, law enforcement), and requirements for individual written authorization. They will also establish individual rights such as access, amendment, deletion, and portability of health information, along with administrative safeguards. Security requirements will mandate physical, technical, and administrative safeguards, particularly for electronic health information, based on national frameworks like NIST cybersecurity goals. Breach notification requirements will be substantially similar to current HIPAA standards.

The bill grants enforcement authority to the Secretary of Health and Human Services, in consultation with the Federal Trade Commission, allowing for civil penalties consistent with HIPAA regulations. It defines "applicable health information" broadly to include identifiable health-related data, even if not created by traditional healthcare entities. Crucially, it defines "regulated entities" and "service providers" to include those outside of HIPAA's traditional scope, explicitly excluding governmental entities and existing HIPAA covered entities or business associates.

Furthermore, the Act modifies patient access rights, requiring a valid authorization for individuals to transmit their protected health information to third parties and allowing covered entities or business associates to condition such transmittal on the recipient paying fees and accepting terms of use. It also limits when fees can be charged for direct patient access or transmission to healthcare providers. The bill mandates a study by the National Academies of Sciences on the risks, benefits, and ethical considerations of compensating patients for sharing identifiable data for research purposes, including examining re-identification risks and opt-in/opt-out opportunities for de-identified data.

New patient notification requirements are introduced, obligating regulated entities or service providers to inform individuals when their health information will no longer be subject to HIPAA protections upon access, and to obtain consent before selling such data. They must also notify individuals about wellness data generation and offer an opt-out option. Finally, the bill requires guidance on applying the "minimum necessary" standard to data used for artificial intelligence and machine learning, and mandates the establishment of unified national standards for de-identifying applicable health information, including the use of privacy-enhancing technologies and contractual agreements to prevent re-identification.