1. Short title This Act may be cited as the Protecting Personal Health Data Act . 2. Findings Congress finds as follows: (1) On July 19, 2016, the Department of Health and Human Services, acting through the Office of the National Coordinator for Health Information Technology and in coordination with the Office for Civil Rights of the Department of Health and Human Services and the Federal Trade Commission, issued a report to Congress entitled Examining Oversight of the Privacy & Security of Health Data Collected by Entities Not Regulated by HIPAA (referred to in this section as the report ) about the need to enact modern protections for consumers’ personal health data. (2) The report states that [t]he wearable fitness trackers, social media sites where individuals share health information through specific social networks, and other technologies that are common today did not exist when Congress enacted the Health Insurance Portability and Accountability Act of 1996 . (3) The report states that entities not covered by the privacy protections of the Health Insurance Portability and Accountability Act of 1996 ( Public Law 104–191 ), such as wearable fitness trackers and health-focused social media sites, engage in a variety of practices such as online advertising and marketing, commercial uses or sale of individual information, and behavioral tracking practices, all of which indicate information use that is likely broader than what individuals would anticipate . (4) The report identifies key gaps that exist between HIPAA regulated entities and those not regulated by HIPAA and recommends addressing those gaps in a way that protects consumers while leveling the playing field for innovators inside and outside of HIPAA . 3. Definitions In this Act: (1) Consumer devices, services, applications, and software (A) In general Except as provided in subparagraph (C), the term consumer devices, services, applications, and software means devices, services, applications, and software— (i) that are primarily designed for or