Illinois 2023-2024 Regular Session

Illinois Senate Bill SB3080 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 SB3080 Introduced 2/2/2024, by Sen. Celina Villanueva SYNOPSIS AS INTRODUCED: New Act815 ILCS 505/2EEEE new Creates the Protect Health Data Privacy Act. Provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information. Sets forth provisions concerning health data privacy policies. Provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances. Provides that it is unlawful for any person to sell or offer to sell health data concerning a consumer without first obtaining valid authorization from the consumer. Provides that a valid authorization to sell consumer health data must contain specified information; a copy of the signed valid authorization must be provided to the consumer; and the seller and purchaser of health data must retain a copy of all valid authorizations for sale of health data for 6 years after the date of its signature or the date when it was last in effect, whichever is later. Sets forth provisions concerning the consent required for collection, sharing, and storage of health data. Provides that a consumer has the right to withdraw consent from the collection, sharing, sale, or storage of the consumer's health data. Provides that it is unlawful for a regulated entity to engage in discriminatory practices against consumers solely because they have not provided consent to the collection, sharing, sale, or storage of their health data or have exercised any other rights provided by the provisions or guaranteed by law. Sets forth provisions concerning a consumer's right to confirm whether a regulated entity is collecting, selling, sharing, or storing any of the consumer's health data; a consumer's right to have the consumer's health data that is collected by a regulated entity deleted; prohibitions regarding geofencing; and consumer health data security. Provides that any person aggrieved by a violation of the provisions shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. Provides that the Attorney General may enforce a violation of the provisions as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Makes a conforming change in the Consumer Fraud and Deceptive Business Practices Act. LRB103 38349 SPS 68484 b A BILL FOR 103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 SB3080 Introduced 2/2/2024, by Sen. Celina Villanueva SYNOPSIS AS INTRODUCED: New Act815 ILCS 505/2EEEE new New Act 815 ILCS 505/2EEEE new Creates the Protect Health Data Privacy Act. Provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information. Sets forth provisions concerning health data privacy policies. Provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances. Provides that it is unlawful for any person to sell or offer to sell health data concerning a consumer without first obtaining valid authorization from the consumer. Provides that a valid authorization to sell consumer health data must contain specified information; a copy of the signed valid authorization must be provided to the consumer; and the seller and purchaser of health data must retain a copy of all valid authorizations for sale of health data for 6 years after the date of its signature or the date when it was last in effect, whichever is later. Sets forth provisions concerning the consent required for collection, sharing, and storage of health data. Provides that a consumer has the right to withdraw consent from the collection, sharing, sale, or storage of the consumer's health data. Provides that it is unlawful for a regulated entity to engage in discriminatory practices against consumers solely because they have not provided consent to the collection, sharing, sale, or storage of their health data or have exercised any other rights provided by the provisions or guaranteed by law. Sets forth provisions concerning a consumer's right to confirm whether a regulated entity is collecting, selling, sharing, or storing any of the consumer's health data; a consumer's right to have the consumer's health data that is collected by a regulated entity deleted; prohibitions regarding geofencing; and consumer health data security. Provides that any person aggrieved by a violation of the provisions shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. Provides that the Attorney General may enforce a violation of the provisions as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Makes a conforming change in the Consumer Fraud and Deceptive Business Practices Act. LRB103 38349 SPS 68484 b LRB103 38349 SPS 68484 b A BILL FOR
2	2	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 SB3080 Introduced 2/2/2024, by Sen. Celina Villanueva SYNOPSIS AS INTRODUCED:
3	3	New Act815 ILCS 505/2EEEE new New Act 815 ILCS 505/2EEEE new
4	4	New Act
5	5	815 ILCS 505/2EEEE new
6	6	Creates the Protect Health Data Privacy Act. Provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information. Sets forth provisions concerning health data privacy policies. Provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances. Provides that it is unlawful for any person to sell or offer to sell health data concerning a consumer without first obtaining valid authorization from the consumer. Provides that a valid authorization to sell consumer health data must contain specified information; a copy of the signed valid authorization must be provided to the consumer; and the seller and purchaser of health data must retain a copy of all valid authorizations for sale of health data for 6 years after the date of its signature or the date when it was last in effect, whichever is later. Sets forth provisions concerning the consent required for collection, sharing, and storage of health data. Provides that a consumer has the right to withdraw consent from the collection, sharing, sale, or storage of the consumer's health data. Provides that it is unlawful for a regulated entity to engage in discriminatory practices against consumers solely because they have not provided consent to the collection, sharing, sale, or storage of their health data or have exercised any other rights provided by the provisions or guaranteed by law. Sets forth provisions concerning a consumer's right to confirm whether a regulated entity is collecting, selling, sharing, or storing any of the consumer's health data; a consumer's right to have the consumer's health data that is collected by a regulated entity deleted; prohibitions regarding geofencing; and consumer health data security. Provides that any person aggrieved by a violation of the provisions shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. Provides that the Attorney General may enforce a violation of the provisions as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Makes a conforming change in the Consumer Fraud and Deceptive Business Practices Act.
7	7	LRB103 38349 SPS 68484 b LRB103 38349 SPS 68484 b
8	8	LRB103 38349 SPS 68484 b
9	9	A BILL FOR
10	10	SB3080LRB103 38349 SPS 68484 b SB3080 LRB103 38349 SPS 68484 b
11	11	SB3080 LRB103 38349 SPS 68484 b
12	12	1 AN ACT concerning regulation.
13	13	2 Be it enacted by the People of the State of Illinois,
14	14	3 represented in the General Assembly:
15	15	4 Section 1. Short title. This Act may be cited as the
16	16	5 Protect Health Data Privacy Act.
17	17	6 Section 5. Definitions. As used in this Act:
18	18	7 "Collect" means to buy, rent, lease, access, retain,
19	19	8 receive, or acquire health data in any manner.
20	20	9 "Consent" means a clear affirmative act by a consumer that
21	21	10 unambiguously communicates the consumer's express, freely
22	22	11 given, informed, opt-in, voluntary, specific, and unambiguous
23	23	12 written agreement, including written consent provided by
24	24	13 electronic means, to the collection, sale, sharing, or storage
25	25	14 of health data. Consent may not be implied, and consent cannot
26	26	15 be obtained by:
27	27	16 (1) acceptance of a general or broad terms of use
28	28	17 agreement or a similar document that contains descriptions
29	29	18 of personal data processing along with other, unrelated
30	30	19 information;
31	31	20 (2) hovering over, muting, pausing, or closing a given
32	32	21 piece of digital content; or
33	33	22 (3) agreement obtained through the use of deceptive
34	34	23 designs.
35	35
36	36
37	37
38	38	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 SB3080 Introduced 2/2/2024, by Sen. Celina Villanueva SYNOPSIS AS INTRODUCED:
39	39	New Act815 ILCS 505/2EEEE new New Act 815 ILCS 505/2EEEE new
40	40	New Act
41	41	815 ILCS 505/2EEEE new
42	42	Creates the Protect Health Data Privacy Act. Provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information. Sets forth provisions concerning health data privacy policies. Provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances. Provides that it is unlawful for any person to sell or offer to sell health data concerning a consumer without first obtaining valid authorization from the consumer. Provides that a valid authorization to sell consumer health data must contain specified information; a copy of the signed valid authorization must be provided to the consumer; and the seller and purchaser of health data must retain a copy of all valid authorizations for sale of health data for 6 years after the date of its signature or the date when it was last in effect, whichever is later. Sets forth provisions concerning the consent required for collection, sharing, and storage of health data. Provides that a consumer has the right to withdraw consent from the collection, sharing, sale, or storage of the consumer's health data. Provides that it is unlawful for a regulated entity to engage in discriminatory practices against consumers solely because they have not provided consent to the collection, sharing, sale, or storage of their health data or have exercised any other rights provided by the provisions or guaranteed by law. Sets forth provisions concerning a consumer's right to confirm whether a regulated entity is collecting, selling, sharing, or storing any of the consumer's health data; a consumer's right to have the consumer's health data that is collected by a regulated entity deleted; prohibitions regarding geofencing; and consumer health data security. Provides that any person aggrieved by a violation of the provisions shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. Provides that the Attorney General may enforce a violation of the provisions as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Makes a conforming change in the Consumer Fraud and Deceptive Business Practices Act.
43	43	LRB103 38349 SPS 68484 b LRB103 38349 SPS 68484 b
44	44	LRB103 38349 SPS 68484 b
45	45	A BILL FOR
46	46
47	47
48	48
49	49
50	50
51	51	New Act
52	52	815 ILCS 505/2EEEE new
53	53
54	54
55	55
56	56	LRB103 38349 SPS 68484 b
57	57
58	58
59	59
60	60
61	61
62	62
63	63
64	64
65	65
66	66	SB3080 LRB103 38349 SPS 68484 b
67	67
68	68
69	69	SB3080- 2 -LRB103 38349 SPS 68484 b SB3080 - 2 - LRB103 38349 SPS 68484 b
70	70	SB3080 - 2 - LRB103 38349 SPS 68484 b
71	71	1 "Consumer" means a person who is a resident of this State,
72	72	2 however identified, including by any unique identifier. A
73	73	3 person located in this State when the person's health data is
74	74	4 collected by a regulated entity shall create a presumption
75	75	5 that the person is a resident of this State for purposes of
76	76	6 enforcing this Act. "Consumer" does not include an individual
77	77	7 acting in a commercial or employment context.
78	78	8 "Deceptive design" means any user interface or element
79	79	9 thereof that has the substantial effect of subverting,
80	80	10 impairing, or impeding an individual's autonomy,
81	81	11 decision-making, or choice.
82	82	12 "Deidentified data" means data that cannot be used to
83	83	13 infer information about, or otherwise be linked to, an
84	84	14 identified or identifiable individual, or a device linked to
85	85	15 such individual. A regulated entity that possesses
86	86	16 deidentified data shall: (i) take reasonable measures to
87	87	17 ensure that such data cannot be associated with an individual;
88	88	18 (ii) publicly commit to process such data only in a
89	89	19 deidentified fashion and not attempt to reidentify such data;
90	90	20 and (iii) contractually obligate any recipients of such data
91	91	21 to satisfy the criteria set forth in items (i) and (ii).
92	92	22 "Geofence" means technology that uses global positioning
93	93	23 coordinates, cell tower connectivity, cellular data, radio
94	94	24 frequency identification, wireless Internet data, or any other
95	95	25 form of spatial or location detection to establish a virtual
96	96	26 boundary around a specific physical location or to locate a
97	97
98	98
99	99
100	100
101	101
102	102	SB3080 - 2 - LRB103 38349 SPS 68484 b
103	103
104	104
105	105	SB3080- 3 -LRB103 38349 SPS 68484 b SB3080 - 3 - LRB103 38349 SPS 68484 b
106	106	SB3080 - 3 - LRB103 38349 SPS 68484 b
107	107	1 consumer within a virtual boundary. For the purposes of this
108	108	2 Act, "geofence" means a virtual boundary that is no more than
109	109	3 1,750 feet around a specific physical location that provides
110	110	4 health services.
111	111	5 "Health data" means information regarding, relating to,
112	112	6 derived, or extrapolated from the past, present, or future
113	113	7 physical or mental health of a consumer, including, but not
114	114	8 limited to, any information relating to:
115	115	9 (1) individual health conditions, treatment, status,
116	116	10 diseases, or diagnoses;
117	117	11 (2) health related surgeries or procedures;
118	118	12 (3) use or purchase of medication;
119	119	13 (4) social, psychological, behavioral, and medical
120	120	14 interventions;
121	121	15 (5) bodily functions, vital signs, measurements, or
122	122	16 symptoms;
123	123	17 (6) diagnoses or diagnostic testing, treatment, or
124	124	18 medication;
125	125	19 (7) efforts to research or obtain health services or
126	126	20 supplies;
127	127	21 (8) health services or products that support or relate
128	128	22 to lawful health care, as defined by Public Act 102-1117;
129	129	23 (9) precise location information that could reasonably
130	130	24 be used to determine a consumer's attempt to acquire or
131	131	25 receive health services or supplies; and
132	132	26 (10) any information described in paragraphs (1)
133	133
134	134
135	135
136	136
137	137
138	138	SB3080 - 3 - LRB103 38349 SPS 68484 b
139	139
140	140
141	141	SB3080- 4 -LRB103 38349 SPS 68484 b SB3080 - 4 - LRB103 38349 SPS 68484 b
142	142	SB3080 - 4 - LRB103 38349 SPS 68484 b
143	143	1 through (9) that is derived or extrapolated from
144	144	2 non-health information, including by use of algorithms or
145	145	3 machine learning, if such information is used or processed
146	146	4 in connection with the advertising, marketing, or
147	147	5 provision of health services.
148	148	6 "Health data" does not include:
149	149	7 (1) personal information collected with the consumer's
150	150	8 consent that is used to engage in public or peer-reviewed
151	151	9 scientific, historical, or statistical research in the
152	152	10 public interest that adheres to all other applicable
153	153	11 ethics and privacy laws and is approved, monitored, and
154	154	12 governed by an institutional review board, human subjects
155	155	13 research ethics review board, or a similar independent
156	156	14 oversight entity that determines that the regulated entity
157	157	15 has implemented reasonable safeguards to mitigate privacy
158	158	16 risks associated with research, including any risks
159	159	17 associated with reidentification; or
160	160	18 (2) deidentified data.
161	161	19 "Health services" means any service, medical care, or
162	162	20 information related to a consumer's health data provided to a
163	163	21 consumer.
164	164	22 "HIPAA" means the Health Insurance Portability and
165	165	23 Accountability Act of 1996, Public Law 104-191, the Health
166	166	24 Information Technology for Economic and Clinical Health Act,
167	167	25 and any subsequent amendments thereto and any regulations
168	168	26 promulgated thereunder, including the Privacy Rule, as
169	169
170	170
171	171
172	172
173	173
174	174	SB3080 - 4 - LRB103 38349 SPS 68484 b
175	175
176	176
177	177	SB3080- 5 -LRB103 38349 SPS 68484 b SB3080 - 5 - LRB103 38349 SPS 68484 b
178	178	SB3080 - 5 - LRB103 38349 SPS 68484 b
179	179	1 specified in 45 CFR 164.500-534, the Security Rule, as
180	180	2 specified in 45 CFR 164.302-318, and the Breach Notification
181	181	3 rule, as specified in 45 CFR 164.400-414.
182	182	4 "Homepage" means the introductory page of a website where
183	183	5 personal information is collected. In the case of an online
184	184	6 service, such as a mobile application, "homepage" means the
185	185	7 application's platform page or download page, such as from the
186	186	8 application configuration, "About" page, "Information" page,
187	187	9 or settings page, and any other location that allows consumers
188	188	10 to review the notice.
189	189	11 "Personal information" means information that identifies,
190	190	12 relates to, describes, is reasonably capable of being
191	191	13 associated with, or linked, directly or indirectly, with a
192	192	14 particular consumer or household. "Personal information" does
193	193	15 not include publicly available information or deidentified
194	194	16 data.
195	195	17 "Precise location information" means information that
196	196	18 identifies the location of an individual within a radius of
197	197	19 1,750 feet. "Precise location information" does not include:
198	198	20 (i) the content of communications, or (ii) any data generated
199	199	21 by or connected to advanced utility metering infrastructure
200	200	22 systems or equipment for use by a utility.
201	201	23 "Processor" means an individual or legal entity that
202	202	24 processes health data on behalf of a regulated entity pursuant
203	203	25 to a written agreement or contract. "Process" or "processing"
204	204	26 means arranging, storing, organizing, structuring, retrieving,
205	205
206	206
207	207
208	208
209	209
210	210	SB3080 - 5 - LRB103 38349 SPS 68484 b
211	211
212	212
213	213	SB3080- 6 -LRB103 38349 SPS 68484 b SB3080 - 6 - LRB103 38349 SPS 68484 b
214	214	SB3080 - 6 - LRB103 38349 SPS 68484 b
215	215	1 transmission, or the otherwise making available of data.
216	216	2 "Publicly available" means information that is lawfully
217	217	3 made available from federal, State, or local government
218	218	4 records.
219	219	5 "Regulated entity" means any individual, partnership,
220	220	6 corporation, limited liability company, association, or other
221	221	7 group, however organized, that: (i) conducts business in this
222	222	8 State or produces products or services that are available to
223	223	9 consumers in this State; and (ii) for any purpose, handles,
224	224	10 collects, shares, sells, stores or otherwise deals with health
225	225	11 data. "Regulated entity" does not include government agencies,
226	226	12 tribal nations, a clerk of the court, or a judge or justice
227	227	13 thereof, or contracted service providers when processing
228	228	14 consumer health data on behalf of the government agency.
229	229	15 "Regulated entity" does not include any entity that is a
230	230	16 covered entity or a business associate, as defined in Section
231	231	17 160.103 of Title 45 of the Code of Federal Regulations,
232	232	18 subject to and in compliance with HIPAA to the extent such
233	233	19 entity is acting as a covered entity or business associate
234	234	20 under the Privacy and Security rules issued by the United
235	235	21 States Department of Health and Human Services, Parts 160 and
236	236	22 164 of Title 45 of the Code of Federal Regulations. "Regulated
237	237	23 entity" does not include any entity that is subject to and in
238	238	24 compliance with restrictions on disclosure of records under
239	239	25 Section 543 of the Public Health Service Act, 42 U.S.C.
240	240	26 290dd2, to the extent such entity is acting in a capacity
241	241
242	242
243	243
244	244
245	245
246	246	SB3080 - 6 - LRB103 38349 SPS 68484 b
247	247
248	248
249	249	SB3080- 7 -LRB103 38349 SPS 68484 b SB3080 - 7 - LRB103 38349 SPS 68484 b
250	250	SB3080 - 7 - LRB103 38349 SPS 68484 b
251	251	1 subject to such restrictions.
252	252	2 "Sell" or "sale" means when a regulated entity, directly
253	253	3 or indirectly, receives any form of remuneration or other
254	254	4 valuable consideration from the use of health data or from the
255	255	5 recipient of the health data in exchange for the health data.
256	256	6 "Sell" does not include:
257	257	7 (1) the sharing of health data to a recipient where
258	258	8 the regulated entity maintains control and ownership of
259	259	9 the health data;
260	260	10 (2) the sharing of health data to comply with
261	261	11 applicable laws or regulations;
262	262	12 (3) the use of the health data by an entity
263	263	13 exclusively at the direction of the regulated entity and
264	264	14 consistent with the purpose for which it was collected and
265	265	15 disclosed; and
266	266	16 (4) the transfer of health data to a third party as an
267	267	17 asset as part of a merger, acquisition, bankruptcy, or
268	268	18 other transaction in which the third party assumes control
269	269	19 of all or part of the regulated entity's assets that shall
270	270	20 comply with the requirements and obligations in this Act.
271	271	21 "Share" means to release, disclose, disseminate, divulge,
272	272	22 loan, make available, provide access to, license, or otherwise
273	273	23 communicate orally, in writing, or by electronic or other
274	274	24 means, health data by a regulated entity to a third party
275	275	25 except where the regulated entity maintains exclusive control
276	276	26 and ownership of the health data. "Share" does not include:
277	277
278	278
279	279
280	280
281	281
282	282	SB3080 - 7 - LRB103 38349 SPS 68484 b
283	283
284	284
285	285	SB3080- 8 -LRB103 38349 SPS 68484 b SB3080 - 8 - LRB103 38349 SPS 68484 b
286	286	SB3080 - 8 - LRB103 38349 SPS 68484 b
287	287	1 (1) the disclosure of health data to a processor that
288	288	2 collects or processes the personal data on behalf of the
289	289	3 regulated entity, when the regulated entity maintains
290	290	4 control and ownership of the data and the processor
291	291	5 maintains or uses the health data only for the regulated
292	292	6 entity's distinct purposes pursuant to a contract;
293	293	7 (2) the disclosure of health data to a third party
294	294	8 with whom the consumer has a direct relationship for
295	295	9 purposes of and only to the extent necessary for providing
296	296	10 a product or service requested by the consumer when the
297	297	11 regulated entity maintains control and ownership of the
298	298	12 data and the third party maintains or uses the health data
299	299	13 only for the regulated entity's distinct purposes; or
300	300	14 (3) the disclosure or transfer of personal data to a
301	301	15 third party as an asset that is part of a merger,
302	302	16 acquisition, bankruptcy, or other transaction in which the
303	303	17 third party assumes control of all or part of the
304	304	18 regulated entity's assets and shall comply with the
305	305	19 requirements and obligations in this Act.
306	306	20 "Strictly necessary" means essential or required to be
307	307	21 done.
308	308	22 "Third party" means an entity other than a consumer,
309	309	23 regulated entity, service provider, or affiliate of the
310	310	24 regulated entity.
311	311	25 Section 10. Scope.
312	312
313	313
314	314
315	315
316	316
317	317	SB3080 - 8 - LRB103 38349 SPS 68484 b
318	318
319	319
320	320	SB3080- 9 -LRB103 38349 SPS 68484 b SB3080 - 9 - LRB103 38349 SPS 68484 b
321	321	SB3080 - 9 - LRB103 38349 SPS 68484 b
322	322	1 (a) This Act applies to consumers seeking, researching, or
323	323	2 obtaining health services within this State, or information
324	324	3 about health services available in this State and regulated
325	325	4 entities.
326	326	5 (b) This Act does not affect an individual's right to
327	327	6 voluntarily share the individual's own health care information
328	328	7 with another person or entity.
329	329	8 Section 15. Health data privacy policy required.
330	330	9 (a) A regulated entity shall disclose and maintain a
331	331	10 health data privacy policy that, in plain language, clearly
332	332	11 and conspicuously discloses:
333	333	12 (1) the specific types of health data collected and
334	334	13 the purpose for which the data is collected and used;
335	335	14 (2) the categories of sources from which the health
336	336	15 data is collected;
337	337	16 (3) the specific types of health data that are shared,
338	338	17 sold, and stored;
339	339	18 (4) the categories of third parties with whom the
340	340	19 regulated entity collects, shares, sells, and stores
341	341	20 health data, and the process to withdraw consent from
342	342	21 having health data collected, shared, sold, and stored;
343	343	22 (5) a list of the specific third parties to which the
344	344	23 regulated entity shares health data, and an active
345	345	24 electronic mail address or other online mechanism that the
346	346	25 consumer may use to contact these third parties free of
347	347
348	348
349	349
350	350
351	351
352	352	SB3080 - 9 - LRB103 38349 SPS 68484 b
353	353
354	354
355	355	SB3080- 10 -LRB103 38349 SPS 68484 b SB3080 - 10 - LRB103 38349 SPS 68484 b
356	356	SB3080 - 10 - LRB103 38349 SPS 68484 b
357	357	1 charge;
358	358	2 (6) how a consumer may exercise the rights provided in
359	359	3 this Act, including, but not limited to, identifying 2 or
360	360	4 more designated methods for a consumer to contact the
361	361	5 regulated entity in connection with the exercise of any
362	362	6 rights provided in this Act;
363	363	7 (7) the length of time the regulated entity intends to
364	364	8 retain each category of health data, or if that is not
365	365	9 possible, the criteria used to determine that period;
366	366	10 however, a regulated entity shall not retain health data
367	367	11 for each disclosed purpose for which the health data was
368	368	12 collected for longer than is reasonably necessary to
369	369	13 fulfill that disclosed purpose; and
370	370	14 (8) whether the regulated entity collects health data
371	371	15 when the consumer is not directly interacting with the
372	372	16 regulated entity or its services.
373	373	17 (b) A regulated entity shall prominently publish or link
374	374	18 to its health data privacy policy on its website homepage, or
375	375	19 in another manner that is clear and conspicuous to consumers.
376	376	20 Its health data privacy policy must be distinguishable from
377	377	21 other matters. Any regulated entity providing health services
378	378	22 in a physical location shall also post its health data privacy
379	379	23 policy in a conspicuous place that is readily available for
380	380	24 viewing by consumers.
381	381	25 (c) A regulated entity shall not collect, share, sell, or
382	382	26 store additional categories of health data not disclosed in
383	383
384	384
385	385
386	386
387	387
388	388	SB3080 - 10 - LRB103 38349 SPS 68484 b
389	389
390	390
391	391	SB3080- 11 -LRB103 38349 SPS 68484 b SB3080 - 11 - LRB103 38349 SPS 68484 b
392	392	SB3080 - 11 - LRB103 38349 SPS 68484 b
393	393	1 the health data privacy policy without first disclosing the
394	394	2 additional categories of health data and obtaining the
395	395	3 consumer's consent before the collection, sharing, selling, or
396	396	4 storing of the health data.
397	397	5 (d) A regulated entity shall not collect, share, sell, or
398	398	6 store health data for additional purposes not disclosed in the
399	399	7 health data privacy policy without first disclosing the
400	400	8 additional purposes and obtaining the consumer's consent
401	401	9 before the collection, sharing, selling, or storing of the
402	402	10 health data.
403	403	11 (e) It is a violation of this Act for a regulated entity to
404	404	12 contract with a processor to process consumer health data in a
405	405	13 manner that is inconsistent with the regulated entity's
406	406	14 consumer health data privacy policy.
407	407	15 Section 20. Prohibition on collection, sharing, or storing
408	408	16 of health data. A regulated entity shall not collect, share,
409	409	17 or store health data, except:
410	410	18 (1) with the consent of the consumer to whom the
411	411	19 information relates for a specified purpose; or
412	412	20 (2) as is strictly necessary to provide a product or
413	413	21 service that the consumer to whom the health data relates
414	414	22 has specifically requested from the regulated entity.
415	415	23 Section 25. Prohibition on sale of health data.
416	416	24 (a) It is unlawful for any person to sell or offer to sell
417	417
418	418
419	419
420	420
421	421
422	422	SB3080 - 11 - LRB103 38349 SPS 68484 b
423	423
424	424
425	425	SB3080- 12 -LRB103 38349 SPS 68484 b SB3080 - 12 - LRB103 38349 SPS 68484 b
426	426	SB3080 - 12 - LRB103 38349 SPS 68484 b
427	427	1 health data concerning a consumer without first obtaining
428	428	2 valid authorization from the consumer. The sale of consumer
429	429	3 health data must be consistent with the valid authorization
430	430	4 signed by the consumer.
431	431	5 (b) A valid authorization to sell consumer health data is
432	432	6 an agreement consistent with this Section and must be written
433	433	7 in plain language. The valid authorization to sell consumer
434	434	8 health data must contain the following:
435	435	9 (1) the specific consumer health data concerning the
436	436	10 consumer that the person intends to sell;
437	437	11 (2) the name and contact information of any person or
438	438	12 entity collecting and selling the health data;
439	439	13 (3) the name and contact information of any person or
440	440	14 entity purchasing the health data from the seller
441	441	15 identified in paragraph (2) of this subsection;
442	442	16 (4) a description of the purpose for the sale,
443	443	17 including how the health data will be gathered and how it
444	444	18 will be used by the purchaser identified in paragraph (3)
445	445	19 of this subsection when sold;
446	446	20 (5) a statement that the provision of goods or
447	447	21 services may not be conditioned on the consumer signing
448	448	22 the valid authorization;
449	449	23 (6) a statement that the consumer has a right to
450	450	24 revoke the valid authorization at any time and a
451	451	25 description on how a consumer may revoke the valid
452	452	26 authorization;
453	453
454	454
455	455
456	456
457	457
458	458	SB3080 - 12 - LRB103 38349 SPS 68484 b
459	459
460	460
461	461	SB3080- 13 -LRB103 38349 SPS 68484 b SB3080 - 13 - LRB103 38349 SPS 68484 b
462	462	SB3080 - 13 - LRB103 38349 SPS 68484 b
463	463	1 (7) a statement that the consumer health data sold
464	464	2 pursuant to the valid authorization may be subject to
465	465	3 redisclosure by the purchaser and may no longer be
466	466	4 protected by this Section;
467	467	5 (8) an expiration date for the valid authorization
468	468	6 that expires one year from when the consumer signs the
469	469	7 valid authorization; and
470	470	8 (9) the signature of the consumer and date.
471	471	9 (c) An authorization is not valid if the document has any
472	472	10 of the following defects:
473	473	11 (1) the expiration date has passed;
474	474	12 (2) the authorization does not contain all the
475	475	13 information required under this Section;
476	476	14 (3) the authorization has been revoked by the
477	477	15 consumer;
478	478	16 (4) the authorization has been combined with other
479	479	17 documents to create a compound authorization; or
480	480	18 (5) the provision of goods or services is conditioned
481	481	19 on the consumer signing the authorization.
482	482	20 (d) A copy of the signed valid authorization must be
483	483	21 provided to the consumer.
484	484	22 (e) The seller and purchaser of health data must retain a
485	485	23 copy of all valid authorizations for sale of health data for 6
486	486	24 years after the date of its signature or the date when it was
487	487	25 last in effect, whichever is later.
488	488
489	489
490	490
491	491
492	492
493	493	SB3080 - 13 - LRB103 38349 SPS 68484 b
494	494
495	495
496	496	SB3080- 14 -LRB103 38349 SPS 68484 b SB3080 - 14 - LRB103 38349 SPS 68484 b
497	497	SB3080 - 14 - LRB103 38349 SPS 68484 b
498	498	1 Section 30. Consent required for collection, sharing, and
499	499	2 storage of health data.
500	500	3 (a) A regulated entity shall not seek consent to collect,
501	501	4 share, or store health data without first disclosing its
502	502	5 health data privacy policy as required under Section 15.
503	503	6 (b) Consent required under this Section must be obtained
504	504	7 before the collection, sharing, or storing, as applicable, of
505	505	8 any health data, and the request for consent must clearly and
506	506	9 conspicuously disclose, separate and apart from its health
507	507	10 data privacy policy:
508	508	11 (1) the categories of health data collected, sold,
509	509	12 shared, or stored;
510	510	13 (2) the purpose of the collection, sharing, or storage
511	511	14 of the health data, including the specific ways in which
512	512	15 it will be used; and
513	513	16 (3) how the consumer can withdraw consent from future
514	514	17 collection, sharing, or storage of their health data.
515	515	18 (c) Consent required under this Section must be obtained
516	516	19 before the use of any health data for any additional purpose
517	517	20 that was not specified before obtaining a consumer's consent
518	518	21 for the use of the health data.
519	519	22 Section 35. Right to withdraw consent. A consumer has the
520	520	23 right to withdraw consent from the collection, sharing, sale,
521	521	24 or storage of the consumer's health data, consistent with the
522	522	25 requirements of Section 30.
523	523
524	524
525	525
526	526
527	527
528	528	SB3080 - 14 - LRB103 38349 SPS 68484 b
529	529
530	530
531	531	SB3080- 15 -LRB103 38349 SPS 68484 b SB3080 - 15 - LRB103 38349 SPS 68484 b
532	532	SB3080 - 15 - LRB103 38349 SPS 68484 b
533	533	1 Section 40. Prohibition on discriminatory practices.
534	534	2 (a) It is unlawful for a regulated entity to engage in
535	535	3 discriminatory practices against a consumer solely because the
536	536	4 consumer has not provided consent to the collection, sharing,
537	537	5 sale, or storage of the consumer's health data pursuant to
538	538	6 this Act, or have exercised any other rights provided by this
539	539	7 Act or guaranteed by law. Discriminatory practices include,
540	540	8 but are not limited to:
541	541	9 (1) denying or limiting goods or services to the
542	542	10 consumer;
543	543	11 (2) imposing additional requirements or restrictions
544	544	12 on the individual that would not be necessary if the
545	545	13 consumer provided their consent;
546	546	14 (3) providing materially different treatment to
547	547	15 consumers who provide consent as compared to consumers who
548	548	16 do not provide consent;
549	549	17 (4) providing or suggesting that the consumer will
550	550	18 receive a lower level or quality of goods or services;
551	551	19 (5) suggesting that the consumer will receive a
552	552	20 different price or rate for goods or services; or
553	553	21 (6) charging different prices or rates for goods or
554	554	22 services, including using discounts or other benefits or
555	555	23 imposing penalties.
556	556	24 (b) It shall not be a discriminatory practice under this
557	557	25 Section to use health data as is strictly necessary to provide
558	558
559	559
560	560
561	561
562	562
563	563	SB3080 - 15 - LRB103 38349 SPS 68484 b
564	564
565	565
566	566	SB3080- 16 -LRB103 38349 SPS 68484 b SB3080 - 16 - LRB103 38349 SPS 68484 b
567	567	SB3080 - 16 - LRB103 38349 SPS 68484 b
568	568	1 a product or service that the consumer to whom the health data
569	569	2 relates has specifically requested from a regulated entity.
570	570	3 Section 45. Right to confirm. A consumer has the right to
571	571	4 confirm whether a regulated entity is collecting, selling,
572	572	5 sharing, or storing any of the consumer's health data, and to
573	573	6 confirm that a regulated entity has deleted the consumer's
574	574	7 health data following a deletion request pursuant to Section
575	575	8 50. A regulated entity that receives a consumer request to
576	576	9 confirm shall respond within 45 calendar days after receiving
577	577	10 the request to confirm from the consumer. The regulated entity
578	578	11 shall, without reasonable delay, promptly take all steps
579	579	12 necessary to verify the consumer's request, but this shall not
580	580	13 extend the regulated entity's duty to respond within 45 days
581	581	14 of receipt of the consumer's request. The time period to
582	582	15 provide the required confirmation may be extended once by an
583	583	16 additional 45 calendar days when reasonably necessary, if the
584	584	17 consumer is provided notice of the extension within the first
585	585	18 45-day period.
586	586	19 Section 50. Right to deletion.
587	587	20 (a) A consumer has the right to have the consumer's health
588	588	21 data that is collected by a regulated entity deleted by
589	589	22 informing the regulated entity of the consumer's request for
590	590	23 deletion, except as provided in subsection (g).
591	591	24 (b) Except as otherwise specified in subsection (f), a
592	592
593	593
594	594
595	595
596	596
597	597	SB3080 - 16 - LRB103 38349 SPS 68484 b
598	598
599	599
600	600	SB3080- 17 -LRB103 38349 SPS 68484 b SB3080 - 17 - LRB103 38349 SPS 68484 b
601	601	SB3080 - 17 - LRB103 38349 SPS 68484 b
602	602	1 regulated entity that receives a consumer request to delete
603	603	2 any of the consumer's health data shall without unreasonable
604	604	3 delay, and no more than 45 calendar days from receiving the
605	605	4 deletion request:
606	606	5 (1) delete the consumer's health data from its
607	607	6 records, including from all parts of the regulated
608	608	7 entity's network; and
609	609	8 (2) notify all service providers, contractors, and
610	610	9 third parties with whom the regulated entity has shared
611	611	10 the consumer's health data of the deletion request.
612	612	11 (c) If a regulated entity stores any health data on
613	613	12 archived or backup systems, it may delay compliance with the
614	614	13 consumer's request to delete with respect to the health data
615	615	14 stored on the archived or backup system until the archived or
616	616	15 backup system relating to that data is restored to an active
617	617	16 system or is next accessed or used.
618	618	17 (d) Any processor, service provider, contractor, and other
619	619	18 third party that receives notice of a consumer's deletion
620	620	19 request from a regulated entity shall honor the consumer's
621	621	20 deletion request and delete the health data from the regulated
622	622	21 entity's records, including from all parts of its network or
623	623	22 backup systems.
624	624	23 (e) A consumer or a consumer's authorized agent may
625	625	24 exercise the rights set forth in this Act by submitting a
626	626	25 request, at any time, to a regulated entity. Such a request may
627	627	26 be made by:
628	628
629	629
630	630
631	631
632	632
633	633	SB3080 - 17 - LRB103 38349 SPS 68484 b
634	634
635	635
636	636	SB3080- 18 -LRB103 38349 SPS 68484 b SB3080 - 18 - LRB103 38349 SPS 68484 b
637	637	SB3080 - 18 - LRB103 38349 SPS 68484 b
638	638	1 (1) contacting the regulated entity through the manner
639	639	2 included in its health data privacy policy;
640	640	3 (2) by designating an authorized agent who may
641	641	4 exercise the rights on behalf of the consumer;
642	642	5 (3) in the case of collecting health data of a minor,
643	643	6 the minor seeking health services may exercise their
644	644	7 rights under this Act, or the parent or legal guardian of
645	645	8 the minor may exercise the rights of this Act on the
646	646	9 minor's behalf; or
647	647	10 (4) in the case of collecting health data concerning a
648	648	11 consumer subject to guardianship, conservatorship, or
649	649	12 other protective arrangement under the Probate Act of
650	650	13 1975, the guardian or the conservator of the consumer may
651	651	14 exercise the rights of this Act on the consumer's behalf.
652	652	15 (f) The time period to delete any of the consumer's health
653	653	16 data may be extended once by an additional 30 calendar days
654	654	17 when reasonably necessary, if the consumer is provided notice
655	655	18 of the extension within the first 30-day period.
656	656	19 (g) Neither a regulated entity nor a processor shall be
657	657	20 required to comply with a consumer's request to delete the
658	658	21 consumer's health data if it is necessary for the regulated
659	659	22 entity or the processor to maintain the consumer's health data
660	660	23 to:
661	661	24 (1) complete the transaction for which the health data
662	662	25 was collected, provide a good or service requested by the
663	663	26 consumer, or otherwise fulfill the requirements of an
664	664
665	665
666	666
667	667
668	668
669	669	SB3080 - 18 - LRB103 38349 SPS 68484 b
670	670
671	671
672	672	SB3080- 19 -LRB103 38349 SPS 68484 b SB3080 - 19 - LRB103 38349 SPS 68484 b
673	673	SB3080 - 19 - LRB103 38349 SPS 68484 b
674	674	1 agreement between the regulated entity and the consumer;
675	675	2 (2) detect security incidents, protect against
676	676	3 malicious, deceptive, fraudulent, or illegal activity, if
677	677	4 the use of health data for such purposes is limited in time
678	678	5 pursuant to a valid record retention schedule;
679	679	6 (3) engage in public or peer-reviewed scientific,
680	680	7 historical, or statistical research in the public interest
681	681	8 that adheres to all other applicable ethics and privacy
682	682	9 laws, if the entities' deletion of the information is
683	683	10 likely to render impossible or seriously impair the
684	684	11 achievement of such research, and if the consumer has
685	685	12 provided consent to such use of their health data;
686	686	13 (4) comply with an applicable legal obligation, such
687	687	14 as data retention requirements set forth in Section 6 of
688	688	15 the Hospital Licensing Act, 45 CFR 164.316, and 45 CFR
689	689	16 164.530;
690	690	17 (5) comply with an applicable legal obligation if the
691	691	18 regulated entity has been notified, in writing by an
692	692	19 attorney, that there is litigation pending in court
693	693	20 involving the consumer's health data as possible evidence
694	694	21 and that the consumer is their client or is the person who
695	695	22 has instituted the litigation against their client, then
696	696	23 the regulated entity shall retain the record of that
697	697	24 consumer until notified in writing by the plaintiff's
698	698	25 attorney, with the approval of the defendant's attorney of
699	699	26 record, that the case in court involving the record has
700	700
701	701
702	702
703	703
704	704
705	705	SB3080 - 19 - LRB103 38349 SPS 68484 b
706	706
707	707
708	708	SB3080- 20 -LRB103 38349 SPS 68484 b SB3080 - 20 - LRB103 38349 SPS 68484 b
709	709	SB3080 - 20 - LRB103 38349 SPS 68484 b
710	710	1 been concluded or for a period of 12 years after the date
711	711	2 that the record was produced, whichever occurs first in
712	712	3 time; or
713	713	4 (6) otherwise use the consumer's health data,
714	714	5 internally, in a lawful manner that is compatible with the
715	715	6 context in which the consumer provided their health data.
716	716	7 Section 55. Authentication of consumer identity.
717	717	8 (a) A regulated entity that receives a consumer request to
718	718	9 confirm or delete may take reasonable measures to authenticate
719	719	10 the consumer's identity to a reasonably high degree of
720	720	11 certainty. A reasonably high degree of certainty may include
721	721	12 matching at least 3 pieces of personal information provided by
722	722	13 the consumer with personal information maintained by the
723	723	14 regulated entity that it has determined to be reliable for the
724	724	15 purpose of authenticating the consumer together with a signed
725	725	16 declaration under penalty of perjury that the consumer making
726	726	17 the request is the consumer whose health data is the subject of
727	727	18 the request. If a regulated entity uses this method for
728	728	19 authentication, the regulated entity shall make all forms
729	729	20 necessary for authentication of a consumer's identity
730	730	21 available to consumers, and shall maintain all signed
731	731	22 declarations as part of its recordkeeping obligations.
732	732	23 (b) A regulated entity is not required to comply with a
733	733	24 consumer request to confirm or delete if the regulated entity,
734	734	25 using commercially reasonable efforts, is unable to
735	735
736	736
737	737
738	738
739	739
740	740	SB3080 - 20 - LRB103 38349 SPS 68484 b
741	741
742	742
743	743	SB3080- 21 -LRB103 38349 SPS 68484 b SB3080 - 21 - LRB103 38349 SPS 68484 b
744	744	SB3080 - 21 - LRB103 38349 SPS 68484 b
745	745	1 authenticate the identity of the consumer making the request.
746	746	2 If a regulated entity is unable to authenticate the consumer's
747	747	3 identity, the regulated entity shall inform the consumer that
748	748	4 it was unable to authenticate the consumer's identity and
749	749	5 advise the consumer of other methods, if available, of
750	750	6 authenticating their identity.
751	751	7 (c) If a regulated entity denies an authenticated consumer
752	752	8 request to delete that consumer's health data, in whole or in
753	753	9 part, because of a conflict with federal or State law, the
754	754	10 regulated entity shall inform the requesting consumer and
755	755	11 explain the basis for the denial, unless prohibited from doing
756	756	12 so by law.
757	757	13 (d) Any information provided by a consumer to a regulated
758	758	14 entity for the purpose of authenticating the consumer's
759	759	15 identity shall not be used for any purpose other than
760	760	16 authenticating the consumer's identity and shall be destroyed
761	761	17 immediately following the authentication process.
762	762	18 Section 60. Consumer health data security and
763	763	19 minimization.
764	764	20 (a) A regulated entity shall restrict access to health
765	765	21 data by the employees, processors, service providers, and
766	766	22 contractors of the regulated entity to only those employees,
767	767	23 processors, services providers, and contractors for which
768	768	24 access is necessary to provide a product or service that the
769	769	25 consumer to whom the health data relates has requested from
770	770
771	771
772	772
773	773
774	774
775	775	SB3080 - 21 - LRB103 38349 SPS 68484 b
776	776
777	777
778	778	SB3080- 22 -LRB103 38349 SPS 68484 b SB3080 - 22 - LRB103 38349 SPS 68484 b
779	779	SB3080 - 22 - LRB103 38349 SPS 68484 b
780	780	1 the regulated entity.
781	781	2 (b) A regulated entity shall establish, implement, and
782	782	3 maintain administrative, technical, and physical data security
783	783	4 practices that at least satisfy a reasonable standard of care
784	784	5 within the regulated entity's industry to protect the
785	785	6 confidentiality, integrity, and accessibility of health data
786	786	7 appropriate to the volume and nature of the personal data at
787	787	8 issue.
788	788	9 Section 65. Prohibition on geofencing.
789	789	10 (a) It shall be unlawful for any person to implement a
790	790	11 geofence that enables the sending of a notification, message,
791	791	12 alert, or other piece of information to a consumer that enters
792	792	13 the perimeter around any entity that provides health services.
793	793	14 (b) It shall be unlawful for any person to implement a
794	794	15 geofence around any entity that provides in-person health care
795	795	16 services where the geofence is used to identify, track, or
796	796	17 collect data from a consumer that enters the virtual
797	797	18 perimeter.
798	798	19 Section 70. Private right of action. Any person aggrieved
799	799	20 by a violation of this Act shall have a right of action in a
800	800	21 State circuit court or as a supplemental claim in federal
801	801	22 district court against an offending party. A prevailing party
802	802	23 may recover for each violation:
803	803	24 (1) against any offending party that negligently
804	804
805	805
806	806
807	807
808	808
809	809	SB3080 - 22 - LRB103 38349 SPS 68484 b
810	810
811	811
812	812	SB3080- 23 -LRB103 38349 SPS 68484 b SB3080 - 23 - LRB103 38349 SPS 68484 b
813	813	SB3080 - 23 - LRB103 38349 SPS 68484 b
814	814	1 violates a provision of this Act, liquidated damages of
815	815	2 $1,000 or actual damages, whichever is greater;
816	816	3 (2) against any offending party that intentionally or
817	817	4 recklessly violates a provision of this Act, liquidated
818	818	5 damages of $5,000 or actual damages, whichever is greater;
819	819	6 (3) reasonable attorney's fees and costs, including
820	820	7 expert witness fees and other litigation expenses; and
821	821	8 (4) other relief, including an injunction, as the
822	822	9 State or federal court may deem appropriate.
823	823	10 Section 75. Enforcement by the Attorney General. The
824	824	11 Attorney General may enforce a violation of this Act as an
825	825	12 unlawful practice under the Consumer Fraud and Deceptive
826	826	13 Business Practices Act. All rights and remedies provided the
827	827	14 Attorney General under the Consumer Fraud and Deceptive
828	828	15 Business Practices Act shall be available for enforcement of a
829	829	16 violation of this Act.
830	830	17 Section 80. Conflict with other laws.
831	831	18 (a) Nothing in this Act shall be construed to prohibit the
832	832	19 lawful and authorized disclosure of health data by regulated
833	833	20 entities to local health departments or State government
834	834	21 agencies or by or among local health departments and State
835	835	22 government agencies as may be required by State and federal
836	836	23 law, including under the Adult Protective Services Act, the
837	837	24 Abused and Neglected Child Reporting Act, the Criminal Code of
838	838
839	839
840	840
841	841
842	842
843	843	SB3080 - 23 - LRB103 38349 SPS 68484 b
844	844
845	845
846	846	SB3080- 24 -LRB103 38349 SPS 68484 b SB3080 - 24 - LRB103 38349 SPS 68484 b
847	847	SB3080 - 24 - LRB103 38349 SPS 68484 b
848	848	1 2012, and the Disclosure of Offenses Against Children Act.
849	849	2 (b) If any provision of this Act, or the application
850	850	3 thereof to any person or circumstance, is held invalid, the
851	851	4 remainder of this Act and the application of such provision to
852	852	5 other persons not similarly situated or to other circumstances
853	853	6 shall not be affected by the invalidation.
854	854	7 (c) This Act shall not apply to personal information
855	855	8 collected, processed, sold, or disclosed subject to the
856	856	9 federal Gramm-Leach-Bliley Act, Public Law 106-102, and
857	857	10 implementing regulations.
858	858	11 Section 900. The Consumer Fraud and Deceptive Business
859	859	12 Practices Act is amended by adding Section 2EEEE as follows:
860	860
861	861
862	862
863	863
864	864
865	865	SB3080 - 24 - LRB103 38349 SPS 68484 b