Plesa Reproductive Health Bill Exempts HIPAA Data From Its Core Limits

The text as introduced · 2,428 words

89R6388 MCF-D

By: Plesa
H.B. No. 2831

A BILL TO BE ENTITLED

AN ACT

relating to the collection of reproductive health information;

imposing a civil penalty.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Chapter 181, Health and Safety Code, is amended

by adding Subchapter F to read as follows:

SUBCHAPTER F. REPRODUCTIVE HEALTH INFORMATION

Sec. 181.301. DEFINITIONS. In this subchapter:

(1) "Collect" means to obtain, receive, or access in

any manner an individual's reproductive health information,

including by actively or passively receiving information from the

individual or observing or tracking the individual's online

activity.

(2) "Covered entity" means a public or private

business or organization, whether for profit or nonprofit, that

provides reproductive health care, placement, or services and

collects reproductive health information from an individual. The

term includes a business or organization that licenses or certifies

another person to provide reproductive health care, placement, or

services.

(3) "Geofence" means technology that uses spatial or

location detection, including global positioning coordinates, cell

tower connectivity, cellular data, radio frequency identification,

or Wi-Fi data, to establish a virtual boundary around a specific

physical location or to locate an individual within a virtual

boundary, provided the virtual boundary is not more than 1,850 feet

from the perimeter of the physical location.

(4) "Process" means any use of information provided

under this subchapter.

(5) "Reproductive health information" means data

reasonably able to identify an individual or the individual's past,

present, or future reproductive health status. The term does not

include data:

(A) that is used to engage in public or

peer-reviewed scientific, historical, or statistical research

performed in the public interest or authorized and provided for use

under Section 161.021 or 161.022; and

(B) the use of which adheres to all other

applicable ethics and privacy laws and for which an institutional

review board, a human subjects research ethics board, or a similar

independent oversight entity has approved, monitored, or governed

that use and determined the covered entity or service provider has

implemented reasonable protections to reduce privacy risks

associated with research, including risks associated with

reidentification.

(6) "Reproductive health services" means health care

services or products supporting or relating to an individual's

reproductive system, pregnancy status, or sexual well-being,

including:

(A) an individual health condition, status,

disease, or diagnosis;

(B) a social, psychological, behavioral, or

medical intervention;

(C) a health-related surgery or procedure,

including abortion;

(D) a use or purchase of a medication;

(E) a bodily function, vital sign, symptom, or

measurement related to information described by this subdivision;

(F) a diagnosis or diagnostic testing,

treatment, or medication; and

(G) a service related to and provided in

conjunction with an abortion, including an associated diagnostic,

counseling, supply, or follow-up service.

(7) "Reproductive health status" includes the

following data related to an individual's reproductive health,

menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to

conceive, or type of sexual activity:

(A) an individual health condition, treatment,

disease, or diagnosis;

(B) a social, psychological, behavioral, or

medical intervention;

(C) a health-related surgery or procedure,

including abortion;

(D) a use or purchase of a medication;

(E) a bodily function, vital sign, symptom, or

measurement related to information described by this subdivision;

(F) a diagnosis or diagnostic testing,

treatment, or medication;

(G) data on services related to and provided in

conjunction with an abortion, including an associated diagnostic,

counseling, supply, or follow-up service;

(H) biometric data generated by automatic

measurements of an individual's biological characteristics,

including a fingerprint, a voiceprint, an eye retina, an iris, or

any other biological pattern or characteristic used to identify a

specific individual, but not including a physical or digital

photograph, a video or audio recording, or any data generated from a

physical or digital photograph or a video or audio recording,

unless the data is generated to identify a specific individual;

(I) genetic data;

(J) precise location information that may

indicate an individual's attempt to acquire or receive reproductive

health services or supplies;

(K) data identifying an individual seeking

reproductive health services or supplies; and

(L) data a covered entity, or a covered entity's

authorized service provider, processes to associate an individual

with the data described by Paragraphs (A)-(K) that is derived or

extrapolated from non-health information, including proxy,

derivative, inferred, or emergent data, algorithms, and machine

learning.

(8) "Service provider" means a person who collects,

processes, retains, transfers, or sells reproductive health

information for and at the direction of a covered entity.

Sec. 181.302. COLLECTION AND USE OF REPRODUCTIVE HEALTH

INFORMATION. (a) A covered entity or service provider may not

collect or process an individual's reproductive health information

unless the covered entity or service provider:

(1) provides to the individual a copy of the covered

entity or service provider's privacy policy;

(2) obtains consent from the individual or the

individual's authorized representative; and

(3) collects or processes the reproductive health

information only for a purpose described by Subsection (b).

(b) A covered entity or service provider may only collect or

process an individual's reproductive health information for the

purpose of:

(1) providing a product, service, or service feature

to the individual who requested the product, service, or service

feature by subscribing to, creating an account with, or otherwise

contracting with the covered entity or service provider;

(2) initiating, managing, executing, or completing a

financial or commercial transaction or fulfilling an order for a

specific product or service at the individual's request, including

associated administrative, operational, and account servicing

activities, such as billing, shipping, storage, and accounting;

(3) complying with an obligation under state or

federal law; or

(4) protecting public safety or public health.

(c) A covered entity or service provider that collects or

processes reproductive health information may not:

(1) collect more precise reproductive health

information than is necessary to perform a purpose described by

Subsection (b);

(2) retain reproductive health information for longer

than is necessary to perform a purpose described by Subsection (b);

(3) derive or infer from reproductive health

information any data not necessary to perform a purpose described

by Subsection (b); or

(4) disclose, cause to disclose, assist with the

disclosure of, or facilitate the disclosure of an individual's

reproductive health information to a third party, unless the

disclosure is:

(A) necessary to perform a purpose described by

Subsection (b); or

(B) performed with the individual's consent

obtained in the manner provided by Section 181.304.

(d) A covered entity or service provider collecting or

processing reproductive health information must provide a clear and

conspicuous link on the covered entity's or service provider's

Internet website to enable an individual, or a person authorized by

the individual, to request access to and deletion of the

individual's reproductive health information.

(e) This section does not apply to a covered entity or a

business associate regarding protected health information under

the Health Insurance Portability And Accountability Act and Privacy

Standards.

(f) In this section, "business associate" has the meaning

assigned by 45 C.F.R. Section 160.103.

Sec. 181.303. DISCLOSURE OF INFORMATION TO GOVERNMENTAL

ENTITY OR OFFICIAL. A covered entity or service provider may not

disclose an individual's reproductive health information to a

federal, state, or local governmental entity or official unless:

(1) the governmental entity or official serves the

covered entity or service provider with a valid warrant or

establishes the existence of exigent circumstances that render

obtaining a warrant impracticable;

(2) disclosure is mandated under state or federal law;

or

(3) the individual to whom the reproductive health

information pertains requests disclosure.

Sec. 181.304. OBTAINING CONSENT. (a) Consent to collect or

process reproductive health care information under Section 181.302

may be obtained electronically, except consent may not be obtained:

(1) by a general or broad terms-of-use agreement or a

similar document containing, with other unrelated information,

descriptions of reproductive health information processing;

(2) by an individual hovering over, muting, pausing,

or not disclosing a given piece of consent information; or

(3) through the use of a deceptive design.

(b) In this section, "deceptive design" means an interface

model or choice architecture designed or manipulated with the

intended effect of subverting or impairing user autonomy, decision

making, or choice or unfairly, fraudulently, or deceptively

manipulating or coercing an individual into providing consent.

Sec. 181.305. SALE OF REPRODUCTIVE HEALTH INFORMATION;

CONSENT. (a) A covered entity or service provider may not sell or

offer to sell an individual's reproductive health information

unless the covered entity or service provider obtains the

individual's consent in accordance with Subsections (c) and (d)

before selling or offering to sell the reproductive health

information.

(b) A covered entity or service provider may not sell or

offer to sell reproductive health information in a manner

inconsistent with the consent obtained under this section.

(c) Consent provided under this section must be in writing,

be in plain language, and include:

(1) a description of the individual's specific

reproductive health information the covered entity or service

provider intends to sell;

(2) the name and contact information of the covered

entity or service provider collecting and selling the reproductive

health information described by Subdivision (1);

(3) the name and contact information of the person

purchasing the reproductive health information described by

Subdivision (1);

(4) a description of the purpose for the sale,

including the manner in which the covered entity or service

provider will collect the reproductive health information and the

person purchasing the reproductive health information will use the

information;

(5) a statement that the provision of goods and

services is not conditioned on the individual signing the consent;

(6) a statement that the individual has a right to

revoke the individual's consent at any time, and a description of

the procedure for submitting a revocation of the consent;

(7) a statement that the reproductive health

information sold may be subject to redisclosure by the person

purchasing the reproductive health information and may no longer be

protected under this section;

(8) the signature of the individual providing consent

and the date on which the consent was signed by the individual; and

(9) an expiration date for the consent, which must be

before the first anniversary of the date the individual signed the

consent.

(d) A covered entity or service provider does not have

consent under this section if the:

(1) expiration date has passed;

(2) consent does not contain all information required

by Subsection (c);

(3) individual has revoked the consent;

(4) consent has been combined with other documents to

create a compound authorization; or

(5) provision of goods or services is conditioned on

the individual signing the consent document.

(e) The covered entity or service provider selling or

offering to sell the reproductive health information shall provide

a copy of the signed, written consent to the individual.

(f) The covered entity or service provider selling or

offering to sell the reproductive health information and the

purchaser of the reproductive health information shall retain a

copy of the signed, written consent until at least the sixth

anniversary of the later of the date the individual signs the

consent or the last date the consent was in effect.

(g) A covered entity or service provider that sells

reproductive health information shall provide a clear and

conspicuous link on the covered entity's or service provider's

Internet website to enable an individual, or a person authorized by

the individual, to at any time revoke the individual's consent to

sell reproductive health information.

(h) A covered entity or service provider selling an

individual's reproductive health information and the purchaser of

the reproductive health information shall enter into a written

agreement governing the purchaser's processing of the individual's

reproductive health information. The written agreement must:

(1) legally bind the purchaser and the covered entity

or service provider selling the reproductive health information;

(2) clearly provide the nature and purpose of the

sale, the type of reproductive health information subject to the

sale, the duration of processing, and the rights and obligations of

both parties;

(3) require the purchaser to adhere to the

instructions of the covered entity or service provider;

(4) establish the extent to which the purchaser may

process the reproductive health information;

(5) require the purchaser to process the reproductive

health information the purchaser receives from the covered entity

or service provider only to the extent provided for by Subdivision

(4); and

(6) require the purchaser to delete or return all

reproductive health information to the covered entity or service

provider at the end of the provision of services or on revocation of

the individual's consent unless retention of the reproductive

health information is required by law.

Sec. 181.306. GEOFENCING. A covered entity or service

provider may not implement a geofence around an entity that

provides in-person reproductive health services if the geofence is

used to:

(1) identify or track individuals seeking

reproductive health services;

(2) collect reproductive health information from

individuals; or

(3) send notifications, messages, or advertisements

to individuals related to the individual's reproductive health

information or reproductive health services.

Sec. 181.307. CAUSE OF ACTION. (a) The attorney general

may bring an action to enjoin a violation of this chapter. On a

proper showing, a court may grant a permanent or temporary

injunction, a restraining order, a writ of mandamus, or any other

order or judgment necessary to enjoin a violation of this

subchapter.

(b) An individual who suffers harm as a result of a

violation of this subchapter may bring a civil action against the

person who committed the violation to recover:

(1) damages in an amount of not less than $100 and not

more than $750 per incident or actual damages, whichever is

greater;

(2) injunctive or declaratory relief; or

(3) any other appropriate relief.

(c) The court may consider any relevant circumstances in

determining the amount of damages, including:

(1) the nature and seriousness of the misconduct;

(2) the number of violations;

(3) the persistence of the misconduct;

(4) the length of time over which the misconduct

occurred;

(5) the wilfulness of the defendant's misconduct; or

(6) the defendant's assets, liabilities, and net

worth.

(d) This subchapter may not be interpreted to create a

private right of action under any other law. This subsection does

not deprive or relieve a person from any rights, duties, or

obligations imposed under other laws of this state or federal law.

Sec. 181.308. RULES. The executive commissioner shall

adopt rules to implement this subchapter.

SECTION 2. As soon as practicable after the effective date

of this Act, the executive commissioner of the Health and Human

Services Commission shall adopt rules necessary to implement

Subchapter F, Chapter 181, Health and Safety Code, as added by this

Act.

SECTION 3. This Act takes effect September 1, 2025.