I
119THCONGRESS
1
STSESSION H. R. 2363
To prohibit the authorization of certain individuals to access certain systems
containing individually identifiable health information.
IN THE HOUSE OF REPRESENTATIVES
MARCH26, 2025
Ms. D
EGETTE(for herself, Mr. GOLDMANof New York, Mr. CARTERof Lou-
isiana, Ms. P
RESSLEY, and Ms. SA´NCHEZ) introduced the following bill;
which was referred to the Committee on Energy and Commerce
A BILL
To prohibit the authorization of certain individuals to access
certain systems containing individually identifiable health
information.
Be it enacted by the Senate and House of Representa-1
tives of the United States of America in Congress assembled, 2
SECTION 1. SHORT TITLE. 3
This Act may be cited as the ‘‘Data Of Government 4
health Entities must be Protected from Overreach by 5
Unelected Nonsecure Disruption Act of 2025’’ or the 6
‘‘DOGE POUND Act of 2025’’. 7
VerDate Sep 11 2014 23:15 Mar 31, 2025 Jkt 059200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H2363.IH H2363
kjohnson on DSK7ZCZBW3PROD with $$_JOB 2
•HR 2363 IH
SEC. 2. PROHIBITING THE AUTHORIZATION OF CERTAIN IN-1
DIVIDUALS TO ACCESS CERTAIN SYSTEMS 2
CONTAINING INDIVIDUALLY IDENTIFIABLE 3
HEALTH INFORMATION. 4
(a) I
NGENERAL.—Notwithstanding any other provi-5
sion of law, no individual may be authorized to use, exer-6
cise administrative control over, or otherwise access any 7
specified system (as defined in subsection (d)), or any data 8
from any such system, unless— 9
(1) such individual is an officer, employee, or 10
contractor of the Department of Health and Human 11
Services who— 12
(A) was otherwise eligible to access such 13
system or data prior to January 20, 2025; and 14
(B) continued to be otherwise eligible to 15
access such system or data between January 16
20, 2025, and the date of access to such system 17
or data; or 18
(2) in the case of an individual not described in 19
paragraph (1)— 20
(A) such individual holds a security clear-21
ance at the appropriate level with respect to 22
such system or data and such clearance was 23
granted pursuant to the procedures established 24
under section 801 of the National Security Act 25
of 1947 (50 U.S.C. 3161); 26
VerDate Sep 11 2014 23:15 Mar 31, 2025 Jkt 059200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H2363.IH H2363
kjohnson on DSK7ZCZBW3PROD with $$_JOB 3
•HR 2363 IH
(B) such individual’s access to such system 1
or data, or use thereof, does not constitute a 2
violation of section 208 of title 18, United 3
States Code (determined after the application of 4
subsection (b)); 5
(C) such individual is not a special Govern-6
ment employee (as defined in section 202 of 7
title 18, United States Code); 8
(D) such individual’s current continuous 9
service in the civil service (as that term is de-10
fined in section 2101 of title 5, United States 11
Code) as of the date of such access is for a pe-12
riod of at least 1 year; 13
(E) such individual has completed any re-14
quired training or compliance procedures with 15
respect to privacy laws and cybersecurity and 16
national security regulations and best practices; 17
and 18
(F) such individual has signed a written 19
ethics agreement with either the Department of 20
Health and Human Services or the Office of 21
Government Ethics. 22
(b) A
PPLICATION OFPENALTIES.— 23
(1) I
N GENERAL.—Whoever knowingly— 24
VerDate Sep 11 2014 23:15 Mar 31, 2025 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H2363.IH H2363
kjohnson on DSK7ZCZBW3PROD with $$_JOB 4
•HR 2363 IH
(A) uses, exercises administrative control 1
over, or otherwise accesses any system or data 2
described in subsection (a) in violation of such 3
subsection, or 4
(B) authorizes the use, exercise of adminis-5
trative control over, or other access to any sys-6
tem or data described in subsection (a) in viola-7
tion of such subsection, 8
shall be imprisoned not more than 5 years or fined 9
under title 18, United States Code, or both. 10
(2) S
TATUTE OF LIMITATIONS .—Notwith-11
standing section 3282 of title 18, United States 12
Code, no person shall be prosecuted, tried, or pun-13
ished for any offense under this subsection unless 14
the indictment is found or the information is insti-15
tuted not later than 10 years after the date on 16
which the offense was committed. 17
(c) R
EPORTS ONUNAUTHORIZEDUSE.—The Inspec-18
tor General of the Department of Health and Human 19
Services shall investigate, and submit a report to Congress 20
on such investigation, each instance of unauthorized use 21
or other access of any specified system. Any such report 22
shall be submitted not later than 30 days after any such 23
instance and shall include— 24
VerDate Sep 11 2014 23:15 Mar 31, 2025 Jkt 059200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H2363.IH H2363
kjohnson on DSK7ZCZBW3PROD with $$_JOB 5
•HR 2363 IH
(1) a detailed description of the unauthorized 1
use or access, including any actions the individual 2
carried out; 3
(2) a risk assessment of any threat to privacy, 4
national security, cybersecurity, or the integrity of 5
the applicable system as a result of such unauthor-6
ized use or access; and 7
(3) a detailed description of any stopped pay-8
ments during the unauthorized use or access. 9
(d) S
PECIFIEDSYSTEM.—For purposes of this sec-10
tion, the term ‘‘specified system’’ means any system main-11
tained by the Department of Health and Human Services 12
that contains individually identifiable health information 13
(as defined in section 1171(6) of the Social Security Act 14
(42 U.S.C. 1320d(6))). 15
Æ
VerDate Sep 11 2014 23:15 Mar 31, 2025 Jkt 059200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6301 E:\BILLS\H2363.IH H2363
kjohnson on DSK7ZCZBW3PROD with $$_JOB