SB 3080
HEALTH DATA PRIVACY ACT
TL;DR
Illinois SB 3080 would create a new health data privacy law regulating how companies collect, use, and share consumer health information outside of HIPAA's reach, including data from wellness apps, fitness trackers, and online health searches. It would require explicit consumer consent, restrict geofencing around healthcare facilities, and give consumers rights to access and delete their health data.
How This Might Impact Your Business
Wellness app makers, fitness tracker companies, telehealth platforms, and digital health startups operating in Illinois would face HIPAA-like rules even though they aren't traditional healthcare providers.
Companies using AI to analyze consumer health data (symptom checkers, mental health chatbots, period tracking apps) would need explicit opt-in consent before collecting or processing that data.
Geofencing advertising around hospitals, clinics, pharmacies, and reproductive health facilities would be prohibited, directly affecting adtech firms, retail pharmacies, and marketing agencies.
Data brokers selling consumer health information would need written authorization from each consumer, effectively breaking many current monetization models.
Consumers would gain rights to access, correct, and delete their health data, requiring companies to build new request-handling infrastructure similar to CCPA compliance.
Violations would likely be enforceable under the Illinois Consumer Fraud Act, exposing companies to Attorney General actions and potential private lawsuits.
No clear small-business exemption has been specified, meaning startups and mid-size health tech firms would face the same obligations as large platforms.
What Should You Do
Map all consumer health data your company collects in Illinois, including data from apps, websites, wearables, and AI tools that infer health conditions.
Audit your advertising and marketing vendors for any geofencing practices near healthcare locations and prepare to disable them in Illinois.
Have your legal team review consent flows and privacy notices to ensure they meet an opt-in (not opt-out) standard for health data.
Assign someone to track this bill through Illinois Senate Assignments Committee and flag any movement to floor vote, since committee referral is an early stage.
Brief your product and engineering teams now on potential data subject access and deletion requirements so they can scope the work before the law passes.
Who It Affects
Status Timeline
committee
Referred to Assignments
February 2, 2024