Secure Data and Privacy for Contact Tracing Act of 2021
Latest action (3 Feb 2021): Introduced
What this bill does
S. 199, the Secure Data and Privacy for Contact Tracing Act of 2021, would authorize the Director of the Centers for Disease Control and Prevention to award grants to state, tribal, and territorial public health agencies to develop, expand, or maintain digital contact-tracing programs for COVID-19. Grant funds could cover technology development, staffing, outreach, and marketing, with up to 10 percent usable for vaccine-related education. To qualify, agencies' digital tools would have to meet specific privacy and security standards—voluntary use with affirmative consent, no linkage to benefits or employment, limited data collection, deletion or de-identification of identifying data within 30 days after the COVID-19 emergency ends, encryption, and independent security assessments. Data could not be used for law enforcement, immigration enforcement, or prosecution, and HIPAA privacy protections would apply. The bill authorizes $75 million and requires a Government Accountability Office evaluation report to Congress within 24 months.
The bill primarily affects state, tribal, and territorial health agencies seeking federal funds for contact-tracing technology, as well as any vendors or "designees" contracted to operate such systems, who would be bound by privacy, security, and data-use restrictions. It also affects the public, whose personal data collected through these programs would be subject to consent and use limitations.
Sponsored by Senator Brian Schatz and cosponsored by Senator Tammy Baldwin, the bill was introduced on February 3, 2021, and referred to the Senate Committee on Health, Education, Labor, and Pensions. It has not received a vote and remains at the introductory stage.
Plain-English summary generated by Bill100 AI from the official record. Always verify against the source below.
Official summary
Secure Data and Privacy for Contact Tracing Act of 2021
This bill establishes grants for state, tribal, and territorial health departments to incorporate digital contact tracing technology in COVID-19 (i.e., coronavirus disease 2019) contact tracing programs. The Centers for Disease Control and Prevention must award the grants.
Any technology developed or procured with these grants must meet privacy, security, and other conditions. Grantees that acquire technology that does not meet these conditions lose eligibility for this, and future, funding for COVID-19 contact tracing technology.
In addition, federal privacy standards for personal health information expressly apply to information transmitted or maintained by grant-funded programs. Current law restricts the use and disclosure of personal health information by health care providers, health plans, health clearinghouses, and their business associates. However, there is an exception to these standards for information used by, or disclosed to, a public health authority.
The bill also prohibits the use of data derived from the contact tracing technology in legal proceedings or for immigration enforcement.
The Government Accountability Office must evaluate this program.
Common questions
- What does S. 199 do?
- S. 199, the Secure Data and Privacy for Contact Tracing Act of 2021, would authorize the Director of the Centers for Disease Control and Prevention to award grants to state, tribal, and territorial public health agencies to develop, expand, or maintain digital contact-tracing programs for COVID-19. Grant funds could cover technology development, staffing, outreach, and marketing, with up to 10 percent usable for vaccine-related education. To qualify, agencies' digital tools would have to meet specific privacy and security standards—voluntary use with affirmative consent, no linkage to benefits or employment, limited data collection, deletion or de-identification of identifying data within 30 days after the COVID-19 emergency ends, encryption, and independent security assessments. Data could not be used for law enforcement, immigration enforcement, or prosecution, and HIPAA privacy protections would apply. The bill authorizes $75 million and requires a Government Accountability Office evaluation report to Congress within 24 months. The bill primarily affects state, tribal, and territorial health agencies seeking federal funds for contact-tracing technology, as well as any vendors or "designees" contracted to operate such systems, who would be bound by privacy, security, and data-use restrictions. It also affects the public, whose personal data collected through these programs would be subject to consent and use limitations. Sponsored by Senator Brian Schatz and cosponsored by Senator Tammy Baldwin, the bill was introduced on February 3, 2021, and referred to the Senate Committee on Health, Education, Labor, and Pensions. It has not received a vote and remains at the introductory stage.
- Has S. 199 become law?
- Not yet. As of 3 Feb 2021, S. 199 is introduced.
- Who sponsored S. 199?
- S. 199 was sponsored by Sen. Brian Schatz [D-HI] (Democrat-HI), with 1 cosponsor.
- What's the latest action on S. 199?
- Introduced (3 Feb 2021).
Related bills in Health
Recognizing the importance of protecting continuous Medicaid coverage for individuals undergoing active cancer treatment.
Wildland Firefighter Health and Safety Act
A resolution supporting the designation of October 2026 as “Substance Use & Misuse Prevention Month” to raise awareness of substance use and misuse in the United States.
Expressing support for the designation of the third week of September as “Fungal Disease Awareness Week” and encouraging efforts to improve awareness, diagnosis, treatment, surveillance, and prevention of fungal diseases in the United States.
Bill100 mirrors the public U.S. legislative record from Congress.gov and GovTrack and adds plain-English AI summaries. It is an information tool, not legal, compliance or lobbying advice, and it is not affiliated with the U.S. Congress or any government agency. AI summaries can simplify or omit detail — every bill links to the official source; verify there before you rely on it.