U.S. advances new data privacy rules

The U.S. Senate unanimously approved HIPRA, with 22 votes in favor and none against, a bill aimed at extending health data protection beyond traditional clinical settings. At the same time, the House of Representatives received other measures on smart meters, data brokers, water and platform liability, all still under review.

What changes under HIPRA?

HIPRA, the Health Information Privacy Reform Act S.3097, was introduced by Senator Bill Cassidy in November 2025 and received the green light from the HELP Committee on July 30, 2026, to move to the Senate floor. The text defines health information broadly and includes data that identifies or could identify a person, even when it does not come from a hospital or a doctor’s office.

According to analysis by Harvard Law School’s Petrie-Flom Center, that can even include data such as a phone’s location history at an addiction treatment clinic. The proposal also creates rights of access, correction, portability and deletion within 30 days. It further requires written consent to sell health data or use it for marketing, and limits disclosures to government agencies to cases involving a court order, subpoena or similar legal process.

What obligations would it create for companies and regulators?

If HIPRA becomes law, the Department of Health and Human Services and the FTC would have up to 18 months to draft detailed standards for privacy, security and breach notification. A compliance analysis by Riddle Compliance says the bill would not replace HIPAA, but rather supplement it by covering health data generated by mobile apps, wearables and other digital services.

The same analysis warns that digital health companies and technology providers should begin designing privacy and security controls aligned with possible future federal requirements. As of September 2026, however, HIPRA remains pending and still needs approval from the full Senate, the House of Representatives and the president’s signature.

What other bills are moving in parallel?

The House also received the Big Tech Accountability Act, introduced by Representative James P. McGovern. According to the statement republished by Quiver Quant, the bill seeks to strengthen online privacy and hold large platforms accountable when their algorithms target and amplify fraudulent misinformation, threats or criminal violence. The available information, however, is based on the lawmaker’s own statement, and no full legislative text or detailed parliamentary status has been published in official sources yet.

Josh Riley, meanwhile, introduced the Smart Meter Data Privacy Protection Act, co-sponsored by Mike Kennedy. The bill, identified as H.R. 10284 and referred on September 3, 2026, to the Energy and Commerce Committee, restricts the sale and commercial use of smart meter data by certain state-regulated utilities.

The text limits use of that data to billing, outage management, grid reliability, regulatory compliance and customer-authorized demand response programs. It also bans licensing, selling, monetizing or otherwise using that information for outside commercial purposes, assigns oversight to the FTC and requires violators to provide bill credits equal to three times the revenue tied to the misuse. Each covered company would also have to file an annual report with the commission.

What about data brokers, water and critical infrastructure?

The SECURE Data Act, introduced in April 2026, seeks to create a federal data broker registry and preempt certain state laws. According to PPC Land, the definition covers intermediaries whose annual gross revenue comes at least 50 percent from selling data about people who are not their direct customers, with the goal of standardizing transparency and compliance rules.

In critical infrastructure, CIRCIA is still waiting for its final rule. The law was enacted in March 2022 and directs CISA to build a mandatory cyber incident reporting system, but those obligations are not yet enforceable. The analysis cited by LBT Technology Group says the anticipated draft would require reports to CISA within 72 hours for covered incidents and within 24 hours for ransomware payments, with effective implementation potentially landing between late 2026 and 2027.

The regulatory agenda also includes the Water Cyber Shield Act of 2026, which, according to the Foundation for Defense of Democracies, would extend requirements similar to those for certain drinking water systems to large wastewater treatment plants for the first time. The proposal would direct the EPA to develop specific standards, conduct cybersecurity assessments and require fixes when significant vulnerabilities are found. In parallel, the EPA is already channeling funds, including $11.75 million for ten projects in medium and large drinking water systems, some of them intended to strengthen industrial cybersecurity.