HB 3603
PROTECT HEALTH DATA ACT
TL;DR
Illinois Rep. Ann Williams and 24 co-sponsors introduced the PROTECT Health Data Act (HB 3603) to tighten how companies collect, share, and sell consumer health data in Illinois. While the bill description is sparse, similar 'protect health data' frameworks in other states restrict tracking of reproductive health, mental health, and biometric data, and often limit AI/algorithmic processing of that data without consent.
How This Might Impact Your Business
Companies handling health-adjacent data (period trackers, mental wellness apps, fitness wearables, telehealth platforms) would likely face new consent and disclosure rules, not just HIPAA-covered entities.
AI vendors training models on health, biometric, or reproductive data sourced from Illinois consumers could face restrictions on data acquisition and resale.
Digital advertisers and data brokers selling health-inferred audience segments (e.g., 'pregnant shoppers,' 'diabetic households') would likely need explicit opt-in consent from Illinois residents.
Retailers and pharmacies using loyalty programs to infer health conditions for personalized marketing would face new disclosure obligations.
Geofencing around clinics, hospitals, and reproductive health facilities is a common target in these bills and would likely be banned or restricted.
Expect a private right of action (Illinois precedent under BIPA has produced multi-million dollar class actions), making non-compliance especially costly.
Bill is newly introduced with growing co-sponsor momentum (25 sponsors); no committee hearing scheduled yet, so specifics may shift.
What Should You Do
Ask your data and privacy team to inventory any consumer health, biometric, reproductive, or mental health data flowing through your AI models, ad targeting, or analytics stack.
Have legal review your current consent flows for Illinois users, especially if you operate apps, wearables, telehealth, or loyalty programs that infer health status.
If you use geolocation data for marketing or analytics, identify whether your data sources include visits to medical facilities and prepare to exclude them.
Track the bill's progress through the Illinois House Health Care Licenses or Privacy Committee and request the full bill text once published to assess specifics.
Brief your CISO and ad-tech leads now; given Illinois's BIPA litigation history, plaintiffs' firms will move fast if this passes.
Who It Affects
Sponsors
Status Timeline
introduced
Added Co-Sponsor Rep. William "Will" Davis
August 17, 2023