The existing fragmented legal baseline
HIPAA applies to defined covered entities and business associates, not to every developer, independent researcher, wellness application or advocacy website that handles health-related information. It provides specific access, disclosure and privacy rules for protected health information. A proposed broad research-data right must state who is covered, including entities not already covered by HIPAA, and what enforcement jurisdiction Congress is creating. F16F17
45 CFR §164.514 defines routes by which information may be de-identified for HIPAA purposes, including the Expert Determination and Safe Harbor methods. Properly de-identified information is generally no longer regulated as protected health information under the HIPAA Privacy Rule. That creates a distinct question for the movement: should the law establish continuing use restrictions through other statutory obligations or contracts even after de-identification? F14F15
The FTC Health Breach Notification Rule addresses certain personal health record vendors and related entities, adding another layer beyond HIPAA. State privacy law, consumer protection, contractual duties and clinical regulations may also apply. Legislative counsel should avoid describing all these regimes as one universal medical-data ownership rule. F17
Pseudonyms, tokens and privacy engineering
A dataset stripped of direct names can still contain combinations of dates, locations, rare diagnoses or genomic variants that permit linkage. A persistent identifier may support longitudinal analysis but can increase re-identification risk when reused across datasets. HIPAA guidance allows certain re-identification codes under specified conditions, while a token, code or hashing operation alone does not prove that a disclosure qualifies as de-identified. F14F15
A research infrastructure can separate personally identifying custody from study-specific observations and keep the mapping encrypted and access-limited. Different projects can receive different pseudonyms, with linkability requiring documented permission. The platform should store private health information in controlled encrypted systems, not directly in a public immutable ledger.
Threat modeling should consider insider misuse, stolen administrator credentials, data linkage from external databases, participant household access, inference attacks, malicious re-identification, compromised analysis environments and long-term key rotation. A consent dashboard and an encryption label will not by themselves prove protection against those threats.
The enforceable participant data charter
Right to understandable access. A participant should receive defined records, purpose summaries and a documented route for correcting factual metadata without silently rewriting original study measurements. Specify a response deadline, supported export formats, responsible custodian and remedy after unexplained failure. Existing HIPAA access rules can serve as precedent but must not be treated as unlimited rights against every organization. F16
Right to purpose-based control. Participants should be able to authorize a named study, time-limited secondary research, sharing with a defined recipient and model-training use as separate choices. Publication of aggregate research findings can be a different permission from commercial redistribution of identifiable records. The law must specify who must enforce downstream restrictions and how affected participants can verify compliance.
Right to withdrawal with accurately stated limits. A dashboard should allow future data collection and future sharing to stop, while disclosing any legally required safety retention, irrevocable publication or previously completed analysis. A promise to erase all effects from a trained AI model is generally not currently technically verifiable, so statute and interfaces should define feasible prospective duties, audit and remedy rather than an impossible guarantee.
Right to independent complaint and accountability. A complaint process should allow a participant to identify a data custodian, request an access log or correction, obtain a written decision and escalate confirmed violations to a named regulator or court if Congress creates that right. Remedies should depend on the breached duty, including notice, specific performance, administrative penalties and proportionate private relief where warranted.
AI research use must be divided by purpose
AI tools may summarize published evidence, help draft protocols, identify inconsistent measurements, run supervised analyses on a restricted dataset, infer outcomes, or update a general model through training. These are distinct technical operations. A consent form stating simply 'AI may be used' gives an individual little idea of whether their records will appear in an external model-training corpus.
The proposed Act can require model-use purpose logs and distinguish research inference from generalized training, third-party API transmission and commercial reuse. A research sponsor should document the technical destination, retention policy and whether outputs could contain participant-specific information. If a recipient breaches a contractual restriction, the system needs an enforceable legal remedy, not only a revoked token.
An academic data governance program should define re-identification tests, differential-privacy or secure aggregation methods only where appropriate, access controls, incident response, data minimization, trusted compute boundaries and independent red-team audits. None of these techniques should be marketed as a universal anonymity certificate. F14F15
The Hypatia/hyJournal concept as a public case study
The initiative can present a hypothetical participant account with separate identity custody, study enrollment token, encrypted longitudinal records, purpose-based AI permissions, revocation history and research export audit. It should be labeled a reference architecture with acceptance criteria, not a claim of a certified or commissioned clinical research platform.
Acceptance criteria include demonstrated separation of research and advocacy data; individual consent to each research use; authorized access and role partitioning; independently verified encryption and recovery procedures; auditable recipient events; documented deletion and retention exceptions; breach response; and clear scientific study governance.
A congressional office could evaluate whether these rights should be enacted through amendments to existing privacy statutes, a new research-data title, or a grant-linked condition for participating entities. An effective statute also needs to define how rights travel with de-identified or derivative information and which limitations prevent unworkable retroactive promises.