Bill Status of HB 3494   104th General Assembly

Short Description:  HEALTH DATA PRIVACY ACT

House Sponsors
Rep. Ann M. Williams, Anne Stava-Murray, Kelly M. Cassidy, Barbara Hernandez and Camille Y. Lilly

Last Action  View All Actions

DateChamber Action
  4/11/2025HouseRule 19(a) / Re-referred to Rules Committee

Statutes Amended In Order of Appearance
New Act
815 ILCS 505/2HHHH new

Synopsis As Introduced
Creates the Protect Health Data Privacy Act. Provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information. Sets forth provisions concerning health data privacy policies. Provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances. Provides that it is unlawful for any person to sell or offer to sell health data concerning an individual without first obtaining valid authorization from the individual. Provides that a valid authorization to sell individual health data must contain specified information; a copy of the signed valid authorization must be provided to the individual; and the seller and purchaser of health data must retain a copy of all valid authorizations for sale of health data for 6 years after the date of its signature or the date when it was last in effect, whichever is later. Sets forth provisions concerning the consent required for collection, sharing, and storage of health data. Provides that an individual has the right to withdraw consent from the processing of the individual's health data. Provides that it is unlawful for a regulated entity to engage in discriminatory practices against individuals solely because they have not provided consent to the processing of their health data or have exercised any other rights provided by the provisions or guaranteed by law. Sets forth provisions concerning an individual's right to confirm whether a regulated entity is collecting, selling, sharing, or storing any of the individual's health data; an individual's right to have the individual's health data that is collected by a regulated entity deleted; prohibitions regarding geofencing; and individual health data security. Provides that any person aggrieved by a violation of the provisions shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. Provides that the Attorney General may enforce a violation of the provisions as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Makes a conforming change in the Consumer Fraud and Deceptive Business Practices Act.

Actions 
DateChamber Action
  2/7/2025HouseFiled with the Clerk by Rep. Ann M. Williams
  2/18/2025HouseFirst Reading
  2/18/2025HouseReferred to Rules Committee
  3/11/2025HouseAssigned to Judiciary - Civil Committee
  3/19/2025HouseDo Pass / Short Debate Judiciary - Civil Committee; 013-007-000
  3/19/2025HousePlaced on Calendar 2nd Reading - Short Debate
  3/19/2025HouseAdded Co-Sponsor Rep. Anne Stava-Murray
  3/24/2025HouseAdded Co-Sponsor Rep. Kelly M. Cassidy
  3/26/2025HouseSecond Reading - Short Debate
  3/26/2025HouseHeld on Calendar Order of Second Reading - Short Debate
  3/26/2025HouseAdded Co-Sponsor Rep. Barbara Hernandez
  4/9/2025HouseAdded Co-Sponsor Rep. Camille Y. Lilly
  4/11/2025HouseRule 19(a) / Re-referred to Rules Committee

Back To Top