HIPAA, but for non-Covered Entities?

On 10 November 2025, DataBreaches[.]Net reported a new bill proposed by Bill Cassidy (R-LA), Chair of the Senate Health, Education, Labour and Pensions Committee, which would apply HIPAA’s privacy and security practices to entities that process non protected health information and their service providers. The proposal aims to treat these non-HIPAA subjects in the same manner as covered entities and business associates under HIPAA.

According to Privacy Compliance & Data Security, Cassidy argues that traditional provider-patient interactions are governed by HIPAA, but consumer health products that connect individuals to health tools outside the doctor’s office are not keeping pace.

The bill would require a plain language disclosure to individuals when an entity not subject to HIPAA accesses their data, indicating that their PHI will no longer be protected under HIPAA, outlining how the information may be disclosed, and obtaining their consent before selling the data. The article notes the emphasis on consumer awareness and data handling transparency as it follows the broader privacy discourse.