UPHOLD Privacy Act of 2023
Latest action (2 Mar 2023): Introduced
What this bill does
Generate a neutral, plain-English explanation of what this bill does, who it affects and what happens next — grounded in the official text.
Official summary
Upholding Protections for Health and Online Location Data Privacy Act of 2023 or the UPHOLD Privacy Act of 2023
This bill restricts the collection, retention, use, and disclosure of personal health data by certain commercial entities (as well as individuals, nonprofits, and common carriers). The bill does not apply to health providers, insurance plans, or related business associates that are subject to the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
Specifically, commercial entities may not collect, retain, use, or disclose personal health data except (1) with the express written consent of the individual to whom such information relates, or (2) as is strictly necessary to provide a requested product or service. Such entities must (1) provide a reasonable means for individuals to access and delete their health data, and (2) maintain and publish a privacy policy disclosing their practices for handling personal health data.
Additionally, the bill prohibits commercial entities from using personal health data for commercial advertising.
The bill also prohibits the sale of location data to or by data brokers, including data volunteered by an individual, data derived from a medical center, data from a wearable fitness tracker, and data from web browsing history.
The bill provides for enforcement by the Federal Trade Commission and by private civil actions.
Common questions
- What does S. 631 do?
- Upholding Protections for Health and Online Location Data Privacy Act of 2023 or the UPHOLD Privacy Act of 2023 This bill restricts the collection, retention, use, and disclosure of personal health data by certain commercial entities (as well as individuals, nonprofits, and common carriers). The bill does not apply to health providers, insurance plans, or related business associates that are subject to the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Specifically, commercial entities may not collect, retain, use, or disclose personal health data except (1) with the express written consent of the individual to whom such information relates, or (2) as is strictly necessary to provide a requested product or service. Such entities must (1) provide a reasonable means for individuals to access and delete their health data, and (2) maintain and publish a privacy policy disclosing their practices for handling personal health data. Additionally, the bill prohibits commercial entities from using personal health data for commercial advertising. The bill also prohibits the sale of location data to or by data brokers, including data volunteered by an individual, data derived from a medical center, data from a wearable fitness tracker, and data from web browsing history. The bill provides for enforcement by the Federal Trade Commission and by private civil actions.
- Has S. 631 become law?
- Not yet. As of 2 Mar 2023, S. 631 is introduced.
- Who sponsored S. 631?
- S. 631 was sponsored by Sen. Amy Klobuchar [D-MN] (Democrat-MN), with 2 cosponsors.
- What's the latest action on S. 631?
- Introduced (2 Mar 2023).
Related bills in Commerce
Critical Infrastructure Manufacturing Feasibility Act
Virginia Graeme Baker Pool and Spa Safety Reauthorization Act
PACK Act
Small Business Payment for Performance Act of 2025
Bill100 mirrors the public U.S. legislative record from Congress.gov and GovTrack and adds plain-English AI summaries. It is an information tool, not legal, compliance or lobbying advice, and it is not affiliated with the U.S. Congress or any government agency. AI summaries can simplify or omit detail — every bill links to the official source; verify there before you rely on it.