SB2273 — HEALTH DATA PRIVACY ACT
Last action — Rule 3-9(a) / Re-referred to Assignments
-
1Introduced
-
2In Committee
-
3Passed Senate
-
4Passed House
-
5To Executive
-
6Enacted
This bill has been introduced in the Senate. Introduced February 07, 2025. It must pass committee before a floor vote.
Next likely step: a committee referral and hearing.
Prognosis
Where this bill stands today.
Odds of enactment
LowHow often bills like it became law.
Not enough signal yet to read this bill's trajectory — we surface a likelihood only once there's real movement (stage, sponsorship, committee, or votes) to point to.
Prognosis reads this bill's own signals — stage, sponsorship breadth, committee status, recorded votes and cross-state momentum. Odds come from a model trained on which bills have become law.
In plain language
The bill regulates the collection, sharing, and sale of health data to protect individuals' privacy.
The Protect Health Data Privacy Act requires entities to maintain clear health data privacy policies and restricts the collection, sharing, and sale of health data without consent. It also grants individuals rights regarding their health data, including the ability to withdraw consent and request deletion.
What this means for you
- Consumers: Consumers will have greater control over their health data, including rights to consent and request deletion.
- Healthcare: Healthcare providers will need to revise their data handling practices to comply with new privacy requirements.
Summary
Creates the Protect Health Data Privacy Act. Provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information. Sets forth provisions concerning health data privacy policies. Provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances. Provides that it is unlawful for any person to sell or offer to sell health data concerning an individual without first obtaining valid authorization from the individual. Provides that a valid authorization to sell individual health data must contain specified information; a copy of the signed valid authorization must be provided to the individual; and the seller and purchaser of health data must retain a copy of all valid authorizations for sale of health data for 6 years after the date of its signature or the date when it was last in effect, whichever is later. Sets forth provisions concerning the consent required for collection, sharing, and storage of health data. Provides that an individual has the right to withdraw consent from the processing of the individual's health data. Provides that it is unlawful for a regulated entity to engage in discriminatory practices against individuals solely because they have not provided consent to the processing of their health data or have exercised any other rights provided by the provisions or guaranteed by law. Sets forth provisions concerning an individual's right to confirm whether a regulated entity is collecting, selling, sharing, or storing any of the individual's health data; an individual's right to have the individual's health data that is collected by a regulated entity deleted; prohibitions regarding geofencing; and individual health data security. Provides that any person aggrieved by a violation of the provisions shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. Provides that the Attorney General may enforce a violation of the provisions as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Makes a conforming change in the Consumer Fraud and Deceptive Business Practices Act.
Bill Text
We don't have the full text on file for this bill yet.
Read SB2273 on the official Illinois source →Action History
-
Rule 3-9(a) / Re-referred to Assignments
-
Rule 3-9(a) / Re-referred to Assignments
-
Rule 2-10 Committee/3rd Reading Deadline Established As May 22, 2026
-
Rule 2-10 Committee/3rd Reading Deadline Established As May 15, 2026
-
Rule 2-10 Committee Deadline Established As April 24, 2026
-
Rule 2-10 Committee Deadline Established As March 27, 2026
-
To AI and Social Media
-
Re-assigned to Executive
-
Rule 3-9(a) / Re-referred to Assignments
-
Rule 2-10 Committee Deadline Established As April 11, 2025
-
To AI and Social Media
-
Assigned to Executive
-
Referred to Assignments
-
First Reading
-
Filed with Secretary by Sen. Celina Villanueva
Sponsors
- Celina Villanueva · Primary
Sponsorship breakdown
Export CSV (upgrade) →1 sponsors · 0 co-sponsors · 182 not signed on
Sponsors (1)
- Celina Villanueva Democrat
Co-sponsors (0)
None.
Not signed on (182)
182 members have not signed on to this bill.
Show all 182 →"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.
Subjects
Frequently asked questions
- What does SB2273 do?
- Creates the Protect Health Data Privacy Act. Provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information. Sets forth provisions concerning health data privacy policies. Provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances. Provides that it is unlawful for any person to sell or offer to sell health data concerning an individual without first obtaining valid authorization from the individual. Provides that a valid authorization to sell individual health data must contain specified information; a copy of the signed valid authorization must be provided to the individual; and the seller and purchaser of health data must retain a copy of all valid authorizations for sale of health data for 6 years after the date of its signature or the date when it was last in effect, whichever is later. Sets forth provisions concerning the consent required for collection, sharing, and storage of health data. Provides that an individual has the right to withdraw consent from the processing of the individual's health data. Provides that it is unlawful for a regulated entity to engage in discriminatory practices against individuals solely because they have not provided consent to the processing of their health data or have exercised any other rights provided by the provisions or guaranteed by law. Sets forth provisions concerning an individual's right to confirm whether a regulated entity is collecting, selling, sharing, or storing any of the individual's health data; an individual's right to have the individual's health data that is collected by a regulated entity deleted; prohibitions regarding geofencing; and individual health data security. Provides that any person aggrieved by a violation of the provisions shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. Provides that the Attorney General may enforce a violation of the provisions as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Makes a conforming change in the Consumer Fraud and Deceptive Business Practices Act.
- Who sponsors SB2273 ?
- SB2273 is sponsored by Celina Villanueva (Democrat).
- What is the current status of SB2273 ?
- This bill has been introduced in the Senate. Introduced February 07, 2025. It must pass committee before a floor vote.
- Where can I track SB2273 ?
- Track SB2273 free on One Click Politics — get push/email alerts when it moves.
Make your voice heard on SB2273
Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.
Stay ahead of SB2273
Last checked for changes 3 months ago · updated continuously
One Click Politics tracks every bill in Congress and all 50 states.
Track this bill →