HB 3284 Protecting personal health data protection outside of emergency periods

This bill provides parameters on use of the personal health data gathered by “covered organizations” via mobile apps during an emergency and requires destroying within 65 days or 30 days after the emergency period ends. Provides protection for consumer data collected while allowing government entities to continue to control our lives in the name of public health.

Personal Choice and Responsibility
Gives 14-year-olds the right to consent to collect, use or disclose personal health data. “Personal health data” is protected data and not for sharing by a covered organizations without expressed consent, which means information that is collected for the purpose of tracking, monitoring or tracing exposures to or infections by SARS-CoV-2 or development of disease conditions caused by or related to COVID-19 and that identifies or can reasonably be used to identify a resident individual and associate the resident individual’s personal identity with: (i) Exposure to or infection by SARS-CoV-2 or development of symptoms of or a disease condition caused by or related to COVID-19; (ii) Tests or examinations or requests for tests and examinations for exposure to SARS-CoV-2, including tests or examinations of body parts or bodily substances; (iii) Receipt of medical care or medical services related to exposure to SARS-CoV-2 or symptoms or development of COVID-19; (iv) Predisposition toward developing a disease condition that results from exposure to or infection by SARS-CoV-2; (v) Whether the resident individual has received a vaccination against COVID-19; or (vi) Other data, including geolocation data derived from technology to locate a person, that tracks, monitors or traces a resident individual’s exposure to or infection by SARS-CoV-2 or development of a disease condition caused by or related to COVID-19.

Limited Government
We all have a right to medical privacy and to participate in society without giving out our vaccine status. The bill gives some protection from the “public square,” however it doesn’t prevent government entities from using personal data to force vaccinations, etc. Requires covered organization (meaning collectors of data other than a health care provider or government entities) to collect, use, receive, process, examine, disclose or collate only personal health data that is reasonably necessary to provide services to resident individual and to provide resident individual with certain disclosures and ability to revoke affirmative express consent for collection, receipt or use of personal health data except in specified circumstances. Punishes violation of Act as unlawful trade practice. Sunsets Act 270 days after COVID-19 emergency period, as defined in Act, ends. Declares emergency, effective on passage.