This bill restricts the commercial use of identifiable personal health information derived from a smartwatch or similar consumer device. The Department of Health and Human Services must enforce these restrictions.

Specifically, an entity that collects personal health information from consumer devices may not transfer, sell, or otherwise allow domestic entities to access such information if the purpose is to increase profits or generate commercial value. However, the bill sets out certain exceptions to this prohibition, including where the consumer provided informed consent or where the information is necessary for specified business transactions.

Furthermore, an entity that collects personal health information derived from consumer devices may not allow foreign entities to access such information unless there are certain privacy and security protections in place.

In addition, any personal health information derived from a consumer device and received by health care providers, health plans, or their business associates is considered protected health information and thus subject to applicable federal privacy standards governing its use and disclosure.