HB 4093
HEALTH DATA PRIVACY ACT
TL;DR
Illinois Rep. Ann Williams and 18 co-sponsors introduced the Health Data Privacy Act to regulate how companies collect, use, and share consumer health data outside of HIPAA's reach (think period-tracking apps, wellness wearables, and mental health platforms). The bill would require explicit consumer consent before processing health data and give Illinois residents new rights to access and delete their information.
How This Might Impact Your Business
Consumer health apps (fertility trackers, mental wellness platforms, fitness wearables) would need explicit opt-in consent before collecting or sharing health data from Illinois residents.
HIPAA-covered hospitals and insurers are largely exempt, but their consumer-facing digital products (patient portal add-ons, wellness programs) may still fall under the new rules.
Companies using AI to infer health conditions from non-medical data (purchase history, location, search queries) would face new restrictions, hitting ad-tech, retail analytics, and data brokers hardest.
Geofencing around healthcare facilities to serve targeted ads would likely be banned, affecting digital advertising and marketing firms.
Consumers gain rights to access, correct, and delete their health data, requiring companies to build new data request workflows.
Enforcement likely runs through the Illinois Attorney General with private right of action possible, following the BIPA model that has produced multi-million dollar settlements.
Currently stalled in the Rules Committee, so immediate passage is unlikely, but Illinois has a track record of passing strict privacy laws (see BIPA).
What Should You Do
Inventory any consumer health data your company collects from Illinois residents, including inferred health data from AI models trained on shopping, location, or behavioral signals.
Have your legal and product teams review consent flows for any wellness, fitness, or health-adjacent features to confirm they meet opt-in standards.
If you run digital ad campaigns, ask your media team whether you use geofencing near hospitals, clinics, or pharmacies and prepare to shut those off.
Track the bill's movement out of Rules Committee; given Illinois's BIPA precedent, prepare a compliance budget estimate now in case it advances next session.
Benchmark your data subject request process against Washington's My Health My Data Act, which this bill closely resembles.
Who It Affects
Sponsors
Status Timeline
committee
Rule 19(a) / Re-referred to Rules Committee
April 19, 2024