Us Congress 2025-2026 Regular Session

Us Congress House Bill HB2363 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	I
2	2	119THCONGRESS
3	3	1
4	4	STSESSION H. R. 2363
5	5	To prohibit the authorization of certain individuals to access certain systems
6	6	containing individually identifiable health information.
7	7	IN THE HOUSE OF REPRESENTATIVES
8	8	MARCH26, 2025
9	9	Ms. D
10	10	EGETTE(for herself, Mr. GOLDMANof New York, Mr. CARTERof Lou-
11	11	isiana, Ms. P
12	12	RESSLEY, and Ms. SA´NCHEZ) introduced the following bill;
13	13	which was referred to the Committee on Energy and Commerce
14	14	A BILL
15	15	To prohibit the authorization of certain individuals to access
16	16	certain systems containing individually identifiable health
17	17	information.
18	18	Be it enacted by the Senate and House of Representa-1
19	19	tives of the United States of America in Congress assembled, 2
20	20	SECTION 1. SHORT TITLE. 3
21	21	This Act may be cited as the ‘‘Data Of Government 4
22	22	health Entities must be Protected from Overreach by 5
23	23	Unelected Nonsecure Disruption Act of 2025’’ or the 6
24	24	‘‘DOGE POUND Act of 2025’’. 7
25	25	VerDate Sep 11 2014 23:15 Mar 31, 2025 Jkt 059200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H2363.IH H2363
26	26	kjohnson on DSK7ZCZBW3PROD with $$_JOB 2
27	27	•HR 2363 IH
28	28	SEC. 2. PROHIBITING THE AUTHORIZATION OF CERTAIN IN-1
29	29	DIVIDUALS TO ACCESS CERTAIN SYSTEMS 2
30	30	CONTAINING INDIVIDUALLY IDENTIFIABLE 3
31	31	HEALTH INFORMATION. 4
32	32	(a) I
33	33	NGENERAL.—Notwithstanding any other provi-5
34	34	sion of law, no individual may be authorized to use, exer-6
35	35	cise administrative control over, or otherwise access any 7
36	36	specified system (as defined in subsection (d)), or any data 8
37	37	from any such system, unless— 9
38	38	(1) such individual is an officer, employee, or 10
39	39	contractor of the Department of Health and Human 11
40	40	Services who— 12
41	41	(A) was otherwise eligible to access such 13
42	42	system or data prior to January 20, 2025; and 14
43	43	(B) continued to be otherwise eligible to 15
44	44	access such system or data between January 16
45	45	20, 2025, and the date of access to such system 17
46	46	or data; or 18
47	47	(2) in the case of an individual not described in 19
48	48	paragraph (1)— 20
49	49	(A) such individual holds a security clear-21
50	50	ance at the appropriate level with respect to 22
51	51	such system or data and such clearance was 23
52	52	granted pursuant to the procedures established 24
53	53	under section 801 of the National Security Act 25
54	54	of 1947 (50 U.S.C. 3161); 26
55	55	VerDate Sep 11 2014 23:15 Mar 31, 2025 Jkt 059200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H2363.IH H2363
56	56	kjohnson on DSK7ZCZBW3PROD with $$_JOB 3
57	57	•HR 2363 IH
58	58	(B) such individual’s access to such system 1
59	59	or data, or use thereof, does not constitute a 2
60	60	violation of section 208 of title 18, United 3
61	61	States Code (determined after the application of 4
62	62	subsection (b)); 5
63	63	(C) such individual is not a special Govern-6
64	64	ment employee (as defined in section 202 of 7
65	65	title 18, United States Code); 8
66	66	(D) such individual’s current continuous 9
67	67	service in the civil service (as that term is de-10
68	68	fined in section 2101 of title 5, United States 11
69	69	Code) as of the date of such access is for a pe-12
70	70	riod of at least 1 year; 13
71	71	(E) such individual has completed any re-14
72	72	quired training or compliance procedures with 15
73	73	respect to privacy laws and cybersecurity and 16
74	74	national security regulations and best practices; 17
75	75	and 18
76	76	(F) such individual has signed a written 19
77	77	ethics agreement with either the Department of 20
78	78	Health and Human Services or the Office of 21
79	79	Government Ethics. 22
80	80	(b) A
81	81	PPLICATION OFPENALTIES.— 23
82	82	(1) I
83	83	N GENERAL.—Whoever knowingly— 24
84	84	VerDate Sep 11 2014 23:15 Mar 31, 2025 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H2363.IH H2363
85	85	kjohnson on DSK7ZCZBW3PROD with $$_JOB 4
86	86	•HR 2363 IH
87	87	(A) uses, exercises administrative control 1
88	88	over, or otherwise accesses any system or data 2
89	89	described in subsection (a) in violation of such 3
90	90	subsection, or 4
91	91	(B) authorizes the use, exercise of adminis-5
92	92	trative control over, or other access to any sys-6
93	93	tem or data described in subsection (a) in viola-7
94	94	tion of such subsection, 8
95	95	shall be imprisoned not more than 5 years or fined 9
96	96	under title 18, United States Code, or both. 10
97	97	(2) S
98	98	TATUTE OF LIMITATIONS .—Notwith-11
99	99	standing section 3282 of title 18, United States 12
100	100	Code, no person shall be prosecuted, tried, or pun-13
101	101	ished for any offense under this subsection unless 14
102	102	the indictment is found or the information is insti-15
103	103	tuted not later than 10 years after the date on 16
104	104	which the offense was committed. 17
105	105	(c) R
106	106	EPORTS ONUNAUTHORIZEDUSE.—The Inspec-18
107	107	tor General of the Department of Health and Human 19
108	108	Services shall investigate, and submit a report to Congress 20
109	109	on such investigation, each instance of unauthorized use 21
110	110	or other access of any specified system. Any such report 22
111	111	shall be submitted not later than 30 days after any such 23
112	112	instance and shall include— 24
113	113	VerDate Sep 11 2014 23:15 Mar 31, 2025 Jkt 059200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H2363.IH H2363
114	114	kjohnson on DSK7ZCZBW3PROD with $$_JOB 5
115	115	•HR 2363 IH
116	116	(1) a detailed description of the unauthorized 1
117	117	use or access, including any actions the individual 2
118	118	carried out; 3
119	119	(2) a risk assessment of any threat to privacy, 4
120	120	national security, cybersecurity, or the integrity of 5
121	121	the applicable system as a result of such unauthor-6
122	122	ized use or access; and 7
123	123	(3) a detailed description of any stopped pay-8
124	124	ments during the unauthorized use or access. 9
125	125	(d) S
126	126	PECIFIEDSYSTEM.—For purposes of this sec-10
127	127	tion, the term ‘‘specified system’’ means any system main-11
128	128	tained by the Department of Health and Human Services 12
129	129	that contains individually identifiable health information 13
130	130	(as defined in section 1171(6) of the Social Security Act 14
131	131	(42 U.S.C. 1320d(6))). 15
132	132	Æ
133	133	VerDate Sep 11 2014 23:15 Mar 31, 2025 Jkt 059200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6301 E:\BILLS\H2363.IH H2363
134	134	kjohnson on DSK7ZCZBW3PROD with $$_JOB