PRINTER'S NO. 1869
THE GENERAL ASSEMBLY OF PENNSYLVANIA
HOUSE BILL
No.
1589
Session of
2023
INTRODUCED BY DALEY, RABB, T. DAVIS, PIELLI, HOHENSTEIN, HILL-
EVANS, MADDEN, BOROWSKI, HANBIDGE, PROBST, HOWARD, DELLOSO,
SCHLOSSBERG, BOYD, KHAN, SANCHEZ, KRAJEWSKI, BENHAM, WAXMAN,
KINSEY, MAYES, SHUSTERMAN, OTTEN, N. NELSON AND CEPEDA-
FREYTIZ, JULY 25, 2023
REFERRED TO COMMITTEE ON HEALTH, JULY 25, 2023
AN ACT
Providing for protection of pregnant individuals' information,
for authorization for disclosure, for data breach and for
violation.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Short title.
This act shall be known and may be cited as the Protection of
Pregnant Individuals' Information Act.
Section 2. Definitions.
The following words and phrases when used in this act shall
have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Health information." Information or data, except age or
gender, whether oral or recorded in a form or medium, created by
or derived from a limited services pregnancy center or an
individual that relates to one or more of the following:
(1) The past, present or future physical, mental or
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
behavioral health or condition of an individual.
(2) A service provided to or discussed with the
individual, including any pregnancy-related service.
"Limited services pregnancy center." A pregnancy services
center that does not directly provide, or provide referrals for,
abortions or emergency contraception and is not covered by
medical privacy laws.
"Nonpublic personal health information." Health information
that identifies an individual who is the subject of the
information or health information that there is a reasonable
basis to believe could be used to identify an individual.
"Pregnancy-related service." A medical or counseling service
related to pregnancy, pregnancy prevention or pregnancy
termination, including contraception and contraceptive
counseling, pregnancy testing, pregnancy diagnosis, pregnancy
options counseling, obstetric ultrasound, obstetric sonogram and
prenatal care.
"Pregnancy services center." A facility, including a mobile
facility, the primary purpose of which is to provide services to
clients who are or have reason to believe that they may be
pregnant and that either:
(1) offers obstetric ultrasounds, obstetric sonograms,
pregnancy testing or diagnosis or prenatal care to pregnant
clients; or
(2) has the appearance of a medical facility by virtue
of having two or more of the following factors present:
(i) staff or volunteers who wear medical attire and
uniforms;
(ii) one or more examination tables;
(iii) a private or semiprivate room or area
20230HB1589PN1869 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
containing medical supplies or medical instruments;
(iv) staff or volunteers who collect health
information from clients; or
(v) the facility is located on the same premises as
a licensed health care facility or health care provider
or shares facility space with a licensed health care
provider.
Section 3. Authorization required for disclosure.
(a) Disclosure prohibited.--A limited services pregnancy
center may not disclose nonpublic personal health information
about an individual unless an authorization is obtained from the
individual whose nonpublic personal health information is sought
to be disclosed.
(b) Exceptions.--A limited services pregnancy center may
disclose nonpublic personal health information without
authorization if disclosure is required to comply with Federal,
State or local laws, a civil, criminal or regulatory inquiry,
investigation, subpoena or summons by Federal, State or local
authorities or to cooperate with law enforcement agencies
concerning conduct or activity that the business, service
provider or third party reasonably and in good faith believes
may violate Federal, State or local laws.
(c) Valid authorization contents.--A valid authorization to
disclose nonpublic personal health information shall be in
written or electronic form and shall contain all of the
following:
(1) The identity of the individual who is the subject of
the nonpublic personal health information.
(2) A general description of the types of nonpublic
personal health information to be disclosed.
20230HB1589PN1869 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(3) General descriptions of the parties to whom the
limited services pregnancy center discloses nonpublic
personal health information, the purpose of the disclosure
and how the information will be used.
(4) The signature of the individual who is the subject
of the nonpublic personal health information or the
individual who is legally empowered to grant authority and
the date signed.
(5) Notice of the length of time for which the
authorization is valid, notice that the individual may revoke
the authorization at any time and the procedure for making a
revocation.
(d) Duration of authorization.--An authorization shall
specify a length of time for which the authorization shall
remain valid, which may not be for more than 24 months.
(e) Revocation of authorization.--An individual who is the
subject of nonpublic personal health information may revoke an
authorization provided under this act at any time, subject to
the rights of a limited services pregnancy center who acted in
reliance on the authorization prior to notice of the revocation.
(f) Record of authorization.--A limited services pregnancy
center shall retain the authorization and a revocation of the
authorization, or copies thereof, for six years in the record of
the individual who is the subject of nonpublic personal health
information.
(g) Nondiscrimination.--A limited services pregnancy center
may not unfairly discriminate against an individual because that
individual has not granted authorization for the disclosure of
nonpublic personal health information under this act.
Section 4. Data breach.
20230HB1589PN1869 - 4 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
A limited services pregnancy center that maintains, stores or
manages computerized nonpublic personal health information shall
provide notice of any breach of the security of the system as
provided under the act of December 22, 2005 (P.L.474, No.94),
known as the Breach of Personal Information Notification Act.
Section 5. Violation.
A violation of this act constitutes unfair methods of
competition and unfair or deceptive acts or practices within the
meaning of section 2(4) of the act of December 17, 1968
(P.L.1224, No.387), known as the Unfair Trade Practices and
Consumer Protection Law, and shall be subject to the enforcement
provisions, civil penalties and private rights of action
specified in that act. Loss of money or property is not required
for private right of action under this act.
Section 6. Effective date.
This act shall take effect in 60 days.
20230HB1589PN1869 - 5 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16