Many consumers automatically assume that their health data is protected under the Health Insurance Portability and Accountability Act (HIPAA), yet HIPAA only applies to Protected Health Information (PHI). PHI is health data created, received, or used by healthcare providers and business associates for care, payment, or operations. Yet, since this information is stored on an app and not a health provider’s system, HIPAA protections aren’t applicable.
Pennsylvania has a statutory gap regarding the protection of health and reproductive privacy. Many health and reproductive apps fail to adequately secure the personal data of their users and sell or allow third-party companies to use their information without the consent or knowledge of the users. Protecting users’ sensitive personal information should be a requirement not a box to check in terms and conditions.
Right now, data brokers can sell your medical information for as little as $0.06 per record. Fitness and reproductive tracking app data, symptom-related Google searches, Pharmacy purchases, wellness online forms, social media posts and likes, and location data are all not protected by HIPAA. Protection of this data falls under the purview of state privacy laws, app store policies, and company privacy practices that are all lacking, putting profits over people.
Meanwhile, we have also witnessed a federal administration that is willing to skirt privacy protections and put profits over its own citizens, having failed to appeal a decision that abandoned the Biden-era HIPAA Privacy Rule to Support Reproductive Health Care Privacy, removing some of its prohibitions on using PHI for criminal or civil investigations related to lawful reproductive care.
That is why I will soon introduce legislation modeled after the federal My Body, My Data legislation that would:
- Prohibit Undisclosed Third-Party Sharing on Health Tracking Apps
- Creation of Specialized Reproductive Data Protections
- Expand protection language of PA’s Department of Health to Include Health Tracking Apps
States including California, Connecticut, Delaware, Illinois, Massachusetts, New Jersey, New Mexico, New York, and the District of Columbia have passed reproductive health data privacy laws pre- and post-Dobbs. These protections prohibit the disclosure of reproductive health data to investigators and prosecutors for criminal or civil proceedings. Having this state-by-state approach leaves the risk that reproductive health data may legally leave a state with protective laws, allowing the data to be accessed by actors in reproductive health in states without the same protection.
Please join me in sponsoring this important legislation.