The AMA recently published a set of privacy principles for health data for consideration as Congress contemplates comprehensive federal privacy legislation. AMA’s goal is to ensure that, as health information is shared, particularly outside of the health care system, patients have meaningful controls over how their data is being used and with whom it is being shared. The principles provide individuals with rights and protections from discrimination and shift the responsibility for privacy from individuals to data holders other than HIPAA-covered entities. The principles also acknowledge that certain information that hasn’t been historically considered personal information -- for example, IP addresses -- should be considered personal.