HB2831 - Relating to the collection of reproductive health information; imposing a civil penalty.

  89R6388 MCF-D     By: Plesa H.B. No. 2831       A BILL TO BE ENTITLED   AN ACT   relating to the collection of reproductive health information;   imposing a civil penalty.          BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:          SECTION 1.  Chapter 181, Health and Safety Code, is amended   by adding Subchapter F to read as follows:   SUBCHAPTER F. REPRODUCTIVE HEALTH INFORMATION           Sec. 181.301.  DEFINITIONS. In this subchapter:                 (1)     "Collect" means to obtain, receive, or access in   any manner an individual's reproductive health information,   including by actively or passively receiving information from the   individual or observing or tracking the individual's online   activity.                 (2)     "Covered entity" means a public or private   business or organization, whether for profit or nonprofit, that   provides reproductive health care, placement, or services and   collects reproductive health information from an individual. The   term includes a business or organization that licenses or certifies   another person to provide reproductive health care, placement, or   services.                 (3)     "Geofence" means technology that uses spatial or   location detection, including global positioning coordinates, cell   tower connectivity, cellular data, radio frequency identification,   or Wi-Fi data, to establish a virtual boundary around a specific   physical location or to locate an individual within a virtual   boundary, provided the virtual boundary is not more than 1,850 feet   from the perimeter of the physical location.                 (4)     "Process" means any use of information provided   under this subchapter.                 (5)     "Reproductive health information" means data   reasonably able to identify an individual or the individual's past,   present, or future reproductive health status. The term does not   include data:                       (A)     that is used to engage in public or   peer-reviewed scientific, historical, or statistical research   performed in the public interest or authorized and provided for use   under Section 161.021 or 161.022; and                       (B)     the use of which adheres to all other   applicable ethics and privacy laws and for which an institutional   review board, a human subjects research ethics board, or a similar   independent oversight entity has approved, monitored, or governed   that use and determined the covered entity or service provider has   implemented reasonable protections to reduce privacy risks   associated with research, including risks associated with   reidentification.                 (6)     "Reproductive health services" means health care   services or products supporting or relating to an individual's   reproductive system, pregnancy status, or sexual well-being,   including:                       (A)     an   individual health condition, status,   disease, or diagnosis;                       (B)     a social, psychological, behavioral, or   medical intervention;                       (C)     a health-related surgery or procedure,   including abortion;                       (D)  a use or purchase of a medication;                       (E)     a bodily function, vital sign, symptom, or   measurement related to information described by this subdivision;                       (F)     a diagnosis or diagnostic testing,   treatment, or medication; and                       (G)     a service related to and provided in   conjunction with an abortion, including an associated diagnostic,   counseling, supply, or follow-up service.                 (7)     "Reproductive health status" includes the   following data related to an individual's reproductive health,   menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to   conceive, or type of sexual activity:                       (A)     an individual health condition, treatment,   disease, or diagnosis;                       (B)     a social, psychological, behavioral, or   medical intervention;                       (C)     a health-related surgery or procedure,   including abortion;                       (D)  a use or purchase of a medication;                       (E)     a bodily function, vital sign, symptom, or   measurement related to information described by this subdivision;                       (F)     a diagnosis or diagnostic testing,   treatment, or medication;                       (G)     data on services related to and provided in   conjunction with an abortion, including an associated diagnostic,   counseling, supply, or follow-up service;                       (H)     biometric data generated by automatic   measurements of an individual's biological characteristics,   including a fingerprint, a voiceprint, an eye retina, an iris, or   any other biological pattern or characteristic used to identify a   specific individual, but not including a physical or digital   photograph, a video or audio recording, or any data generated from a   physical or digital photograph or a video or audio recording,   unless the data is generated to identify a specific individual;                       (I)  genetic data;                       (J)     precise location information that may   indicate an individual's attempt to acquire or receive reproductive   health services or supplies;                       (K)     data identifying an individual seeking   reproductive health services or supplies; and                       (L)     data a covered entity, or a covered entity's   authorized service provider, processes to associate an individual   with the data described by Paragraphs (A)-(K) that is derived or   extrapolated from non-health information, including proxy,   derivative, inferred, or emergent data, algorithms, and machine   learning.                 (8)     "Service provider" means a person who collects,   processes, retains, transfers, or sells reproductive health   information for and at the direction of a covered entity.           Sec.   181.302.     COLLECTION AND USE OF REPRODUCTIVE HEALTH   INFORMATION. (a) A covered entity or service provider may not   collect or process an individual's reproductive health information   unless the covered entity or service provider:                 (1)     provides to the individual a copy of the covered   entity or service provider's privacy policy;                 (2)     obtains consent from the individual or the   individual's authorized representative; and                 (3)     collects or processes the reproductive health   information only for a purpose described by Subsection (b).           (b)     A covered entity or service provider may only collect or   process an individual's reproductive health information for the   purpose of:                 (1)     providing a product, service, or service feature   to the individual who requested the product, service, or service   feature by subscribing to, creating an account with, or otherwise   contracting with the covered entity or service provider;                 (2)     initiating, managing, executing, or completing a   financial or commercial transaction or fulfilling an order for a   specific product or service at the individual's request, including   associated administrative, operational, and account servicing   activities, such as billing, shipping, storage, and accounting;                 (3)     complying with an obligation under state or   federal law; or                 (4)  protecting public safety or public health.           (c)     A covered entity or service provider that collects or   processes reproductive health information may not:                 (1)     collect more precise reproductive health   information than is necessary to perform a purpose described by   Subsection (b);                 (2)     retain reproductive health information for longer   than is necessary to perform a purpose described by Subsection (b);                 (3)     derive or infer from reproductive health   information any data not necessary to perform a purpose described   by Subsection (b); or                 (4)     disclose, cause to disclose, assist with the   disclosure of, or facilitate the disclosure of an individual's   reproductive health information to a third party, unless the   disclosure is:                       (A)     necessary to perform a purpose described by   Subsection (b); or                       (B)     performed with the individual's consent   obtained in the manner provided by Section 181.304.           (d)     A covered entity or service provider collecting or   processing reproductive health information must provide a clear and   conspicuous link on the covered entity's or service provider's   Internet website to enable an individual, or a person authorized by   the individual, to request access to and deletion of the   individual's reproductive health information.           (e)     This section does not apply to a covered entity or a   business associate regarding protected health information under   the Health Insurance Portability And Accountability Act and Privacy   Standards.           (f)     In this section, "business associate" has the meaning   assigned by 45 C.F.R. Section 160.103.           Sec.   181.303.     DISCLOSURE OF INFORMATION TO GOVERNMENTAL   ENTITY OR OFFICIAL. A covered entity or service provider may not   disclose an individual's reproductive health information to a   federal, state, or local governmental entity or official unless:                 (1)     the governmental entity or official serves the   covered entity or service provider with a valid warrant or   establishes the existence of exigent circumstances that re [Text truncated for display. Full text available on Congress.gov.]