89R6388 MCF-D

By: Plesa H.B. No. 2831

A BILL TO BE ENTITLED

AN ACT

relating to the collection of reproductive health information; imposing a civil penalty.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Chapter 181, Health and Safety Code, is amended by adding Subchapter F to read as follows:

SUBCHAPTER F. REPRODUCTIVE HEALTH INFORMATION

Sec. 181.301. DEFINITIONS. In this subchapter:

(1) "Collect" means to obtain, receive, or access in any manner an individual's reproductive health information, including by actively or passively receiving information from the individual or observing or tracking the individual's online activity.

(2) "Covered entity" means a public or private business or organization, whether for profit or nonprofit, that provides reproductive health care, placement, or services and collects reproductive health information from an individual. The term includes a business or organization that licenses or certifies another person to provide reproductive health care, placement, or services.

(3) "Geofence" means technology that uses spatial or location detection, including global positioning coordinates, cell tower connectivity, cellular data, radio frequency identification, or Wi-Fi data, to establish a virtual boundary around a specific physical location or to locate an individual within a virtual boundary, provided the virtual boundary is not more than 1,850 feet from the perimeter of the physical location.

(4) "Process" means any use of information provided under this subchapter.

(5) "Reproductive health information" means data reasonably able to identify an individual or the individual's past, present, or future reproductive health status. The term does not include data:

(A) that is used to engage in public or peer-reviewed scientific, historical, or statistical research performed in the public interest or authorized and provided for use under Section 161.021 or 161.022; and

(B) the use of which adheres to all other applicable ethics and privacy laws and for which an institutional review board, a human subjects research ethics board, or a similar independent oversight entity has approved, monitored, or governed that use and determined the covered entity or service provider has implemented reasonable protections to reduce privacy risks associated with research, including risks associated with reidentification.

(6) "Reproductive health services" means health care services or products supporting or relating to an individual's reproductive system, pregnancy status, or sexual well-being, including:

(A) an individual health condition, status, disease, or diagnosis;

(B) a social, psychological, behavioral, or medical intervention;

(C) a health-related surgery or procedure, including abortion;

(D) a use or purchase of a medication;

(E) a bodily function, vital sign, symptom, or measurement related to information described by this subdivision;

(F) a diagnosis or diagnostic testing, treatment, or medication; and

(G) a service related to and provided in conjunction with an abortion, including an associated diagnostic, counseling, supply, or follow-up service.

(7) "Reproductive health status" includes the following data related to an individual's reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity:

(A) an individual health condition, treatment, disease, or diagnosis;

(B) a social, psychological, behavioral, or medical intervention;

(C) a health-related surgery or procedure, including abortion;

(D) a use or purchase of a medication;

(E) a bodily function, vital sign, symptom, or measurement related to information described by this subdivision;

(F) a diagnosis or diagnostic testing, treatment, or medication;

(G) data on services related to and provided in conjunction with an abortion, including an associated diagnostic, counseling, supply, or follow-up service;

(H) biometric data generated by automatic measurements of an individual's biological characteristics, including a fingerprint, a voiceprint, an eye retina, an iris, or any other biological pattern or characteristic used to identify a specific individual, but not including a physical or digital photograph, a video or audio recording, or any data generated from a physical or digital photograph or a video or audio recording, unless the data is generated to identify a specific individual;

(I) genetic data;

(J) precise location information that may indicate an individual's attempt to acquire or receive reproductive health services or supplies;

(K) data identifying an individual seeking reproductive health services or supplies; and

(L) data a covered entity, or a covered entity's authorized service provider, processes to associate an individual with the data described by Paragraphs (A)-(K) that is derived or extrapolated from non-health information, including proxy, derivative, inferred, or emergent data, algorithms, and machine learning.

(8) "Service provider" means a person who collects, processes, retains, transfers, or sells reproductive health information for and at the direction of a covered entity.

Sec. 181.302. COLLECTION AND USE OF REPRODUCTIVE HEALTH INFORMATION. (a) A covered entity or service provider may not collect or process an individual's reproductive health information unless the covered entity or service provider:

(1) provides to the individual a copy of the covered entity or service provider's privacy policy;

(2) obtains consent from the individual or the individual's authorized representative; and

(3) collects or processes the reproductive health information only for a purpose described by Subsection (b).

(b) A covered entity or service provider may only collect or process an individual's reproductive health information for the purpose of:

(1) providing a product, service, or service feature to the individual who requested the product, service, or service feature by subscribing to, creating an account with, or otherwise contracting with the covered entity or service provider;

(2) initiating, managing, executing, or completing a financial or commercial transaction or fulfilling an order for a specific product or service at the individual's request, including associated administrative, operational, and account servicing activities, such as billing, shipping, storage, and accounting;

(3) complying with an obligation under state or federal law; or

(4) protecting public safety or public health.

(c) A covered entity or service provider that collects or processes reproductive health information may not:

(1) collect more precise reproductive health information than is necessary to perform a purpose described by Subsection (b);

(2) retain reproductive health information for longer than is necessary to perform a purpose described by Subsection (b);

(3) derive or infer from reproductive health information any data not necessary to perform a purpose described by Subsection (b); or

(4) disclose, cause to disclose, assist with the disclosure of, or facilitate the disclosure of an individual's reproductive health information to a third party, unless the disclosure is:

(A) necessary to perform a purpose described by Subsection (b); or

(B) performed with the individual's consent obtained in the manner provided by Section 181.304.

(d) A covered entity or service provider collecting or processing reproductive health information must provide a clear and conspicuous link on the covered entity's or service provider's Internet website to enable an individual, or a person authorized by the individual, to request access to and deletion of the individual's reproductive health information.

(e) This section does not apply to a covered entity or a business associate regarding protected health information under the Health Insurance Portability And Accountability Act and Privacy Standards.

(f) In this section, "business associate" has the meaning assigned by 45 C.F.R. Section 160.103.

Sec. 181.303. DISCLOSURE OF INFORMATION TO GOVERNMENTAL ENTITY OR OFFICIAL. A covered entity or service provider may not disclose an individual's reproductive health information to a federal, state, or local governmental entity or official unless:

(1) the governmental entity or official serves the covered entity or service provider with a valid warrant or establishes the existence of exigent circumstances that render obtaining a warrant impracticable;

(2) disclosure is mandated under state or federal law; or

(3) the individual to whom the reproductive health information pertains requests disclosure.

Sec. 181.304. OBTAINING CONSENT. (a) Consent to collect or process reproductive health care information under Section 181.302 may be obtained electronically, except consent may not be obtained:

(1) by a general or broad terms-of-use agreement or a similar document containing, with other unrelated information, descriptions of reproductive health information processing;

(2) by an individual hovering over, muting, pausing, or not disclosing a given piece of consent information; or

(3) through the use of a deceptive design.

(b) In this section, "deceptive design" means an interface model or choice architecture designed or manipulated with the intended effect of subverting or impairing user autonomy, decision making, or choice or unfairly, fraudulently, or deceptively manipulating or coercing an individual into providing consent.

Sec. 181.305. SALE OF REPRODUCTIVE HEALTH INFORMATION; CONSENT. (a) A covered entity or service provider may not sell or offer to sell an individual's reproductive health information unless the covered entity or service provider obtains the individual's consent in accordance with Subsections (c) and (d) before selling or offering to sell the reproductive health information.

(b) A covered entity or service provider may not sell or offer to sell reproductive health information in a manner inconsistent with the consent obtained under this section.

(c) Consent provided under this section must be in writing, be in plain language, and include:

(1) a description of the individual's specific reproductive health information the covered entity or service provider intends to sell;

(2) the name and contact information of the covered entity or service provider collecting and selling the reproductive health information described by Subdivision (1);

(3) the name and contact information of the person purchasing the reproductive health information described by Subdivision (1);

(4) a description of the purpose for the sale, including the manner in which the covered entity or service provider will collect the reproductive health information and the person purchasing the reproductive health information will use the information;

(5) a statement that the provision of goods and services is not conditioned on the individual signing the consent;

(6) a statement that the individual has a right to revoke the individual's consent at any time, and a description of the procedure for submitting a revocation of the consent;

(7) a statement that the reproductive health information sold may be subject to redisclosure by the person purchasing the reproductive health information and may no longer be protected under this section;

(8) the signature of the individual providing consent and the date on which the consent was signed by the individual; and

(9) an expiration date for the consent, which must be before the first anniversary of the date the individual signed the consent.

(d) A covered entity or service provider does not have consent under this section if the:

(1) expiration date has passed;

(2) consent does not contain all information required by Subsection (c);

(3) individual has revoked the consent;

(4) consent has been combined with other documents to create a compound authorization; or

(5) provision of goods or services is conditioned on the individual signing the consent document.

(e) The covered entity or service provider selling or offering to sell the reproductive health information shall provide a copy of the signed, written consent to the individual.

(f) The covered entity or service provider selling or offering to sell the reproductive health information and the purchaser of the reproductive health information shall retain a copy of the signed, written consent until at least the sixth anniversary of the later of the date the individual signs the consent or the last date the consent was in effect.

(g) A covered entity or service provider that sells reproductive health information shall provide a clear and conspicuous link on the covered entity's or service provider's Internet website to enable an individual, or a person authorized by the individual, to at any time revoke the individual's consent to sell reproductive health information.

(h) A covered entity or service provider selling an individual's reproductive health information and the purchaser of the reproductive health information shall enter into a written agreement governing the purchaser's processing of the individual's reproductive health information. The written agreement must:

(1) legally bind the purchaser and the covered entity or service provider selling the reproductive health information;

(2) clearly provide the nature and purpose of the sale, the type of reproductive health information subject to the sale, the duration of processing, and the rights and obligations of both parties;

(3) require the purchaser to adhere to the instructions of the covered entity or service provider;

(4) establish the extent to which the purchaser may process the reproductive health information;

(5) require the purchaser to process the reproductive health information the purchaser receives from the covered entity or service provider only to the extent provided for by Subdivision (4); and

(6) require the purchaser to delete or return all reproductive health information to the covered entity or service provider at the end of the provision of services or on revocation of the individual's consent unless retention of the reproductive health information is required by law.

Sec. 181.306. GEOFENCING. A covered entity or service provider may not implement a geofence around an entity that provides in-person reproductive health services if the geofence is used to:

(1) identify or track individuals seeking reproductive health services;

(2) collect reproductive health information from individuals; or

(3) send notifications, messages, or advertisements to individuals related to the individual's reproductive health information or reproductive health services.

Sec. 181.307. CAUSE OF ACTION. (a) The attorney general may bring an action to enjoin a violation of this chapter. On a proper showing, a court may grant a permanent or temporary injunction, a restraining order, a writ of mandamus, or any other order or judgment necessary to enjoin a violation of this subchapter.

(b) An individual who suffers harm as a result of a violation of this subchapter may bring a civil action against the person who committed the violation to recover:

(1) damages in an amount of not less than $100 and not more than $750 per incident or actual damages, whichever is greater;

(2) injunctive or declaratory relief; or

(3) any other appropriate relief.

(c) The court may consider any relevant circumstances in determining the amount of damages, including:

(1) the nature and seriousness of the misconduct;

(2) the number of violations;

(3) the persistence of the misconduct;

(4) the length of time over which the misconduct occurred;

(5) the wilfulness of the defendant's misconduct; or

(6) the defendant's assets, liabilities, and net worth.

(d) This subchapter may not be interpreted to create a private right of action under any other law. This subsection does not deprive or relieve a person from any rights, duties, or obligations imposed under other laws of this state or federal law.

Sec. 181.308. RULES. The executive commissioner shall adopt rules to implement this subchapter.

SECTION 2. As soon as practicable after the effective date of this Act, the executive commissioner of the Health and Human Services Commission shall adopt rules necessary to implement Subchapter F, Chapter 181, Health and Safety Code, as added by this Act.

SECTION 3. This Act takes effect September 1, 2025.