An Act to Protect Personal Health Data
Maine Legislature, Session 131, LD 1902
Committee: Judiciary
Sponsors: O'NEIL, DAUGHTRY, BRENNAN, MATHIESON, RANA, ROEDER, SHEEHAN, SUPICA, TALBOT ROSS, BRENNER

Legislative Document
No. 1902
H.P. 1217
House of Representatives, May 9, 2023
An Act to Protect Personal Health Data
Reference to the Committee on Judiciary suggested and ordered printed.
ROBERT B. HUNT
Clerk
Presented by Representative O'NEIL of Saco.
Cosponsored by Senator DAUGHTRY of Cumberland and
Representatives: BRENNAN of Portland, MATHIESON of Kittery, RANA of Bangor, 
ROEDER of Bangor, SHEEHAN of Biddeford, SUPICA of Bangor, Speaker TALBOT ROSS 
of Portland, Senator: BRENNER of Cumberland.
Be it enacted by the People of the State of Maine as follows:
Sec. 1.  10 MRSA c. 210-C is enacted to read:
CHAPTER 210-C
MY HEALTH MY DATA ACT
§1350-M.  Short title
This chapter may be known and cited as "the My Health My Data Act."  
§1350-N.  Definitions
As used in this chapter, unless the context otherwise indicates, the following terms 
have the following meanings.
1. Abortion.  "Abortion" has the same meaning as in Title 22, section 1596, subsection 
1, paragraph A.
2. Affiliate.  "Affiliate" means a legal entity that shares common branding with another 
legal entity and controls, is controlled by or is under common control with another legal 
entity. For the purposes of this definition, "control" means:
A. Ownership of, or the power to vote, more than 50% of the outstanding shares of any 
class of voting security of a company; 
B. Influence in any manner over the election of a majority of the directors or of 
individuals exercising similar functions; or 
C. The power to exercise direct influence over the management of a company.
3. Biometric data. "Biometric data" means data generated from the measurement or 
technological processing of an individual's physiological, biological or behavioral 
characteristics that can be used individually or in combination with other data to identify a 
consumer. "Biometric data" includes, but is not limited to: 
A. Imagery of the iris, retina, fingerprint, face, hand, palm and vein patterns and voice 
recordings, from which an identifier template can be extracted; or
B. Keystroke patterns or rhythms, gait patterns or rhythms and sleep, health or exercise 
data that contain identifying information.
4. Collect. "Collect" means to buy, rent, access, retain, receive, acquire, infer, derive 
or otherwise process consumer health data in any manner.
5. Consent.  "Consent" means an affirmative act by a consumer that clearly 
communicates a consumer's opt-in, voluntary, specific and unambiguous written 
authorization for an act or practice after having been informed, in response to a specific 
request from a regulated entity that meets the requirements of section 1350-P.  "Consent" 
may include written consent provided by electronic means. "Consent" cannot be obtained 
by:
A. A consumer's acceptance of a general or broad terms of use agreement or a similar 
document that contains descriptions of personal data processing along with other 
unrelated information; 
B. A consumer's hovering over, muting, pausing or closing a given piece of content;
C. The use of any false, fictitious, fraudulent or materially misleading statement or 
representation; or
D.  The design, modification or manipulation of any user interface with the purpose or 
substantial effect of obscuring, subverting or impairing a reasonable consumer's 
autonomy, decision making or choice to provide such consent or any consumer health 
data.
6. Consumer. "Consumer" means an individual who is a resident of this State or an 
individual whose consumer health data is collected in this State. "Consumer" does not 
include an individual acting in an employment context.
7. Consumer health data. "Consumer health data" means personal information that 
describes or reveals the past, present or future physical health, mental health, disability, 
diagnosis or health condition of a consumer, including, but not limited to, any personal 
information relating to:
A. Individual health conditions, treatment, status, diseases or diagnoses;
B. Social, psychological, behavioral and medical interventions;
C. Noncosmetic surgeries or health-related procedures;
D. Use or purchase of medication;
E. Bodily functions, vital signs, symptoms or measurements of the information 
described in this subsection;
F. Diagnoses or diagnostic testing, treatment or medication; 
G. Efforts to research or obtain health care services or supplies; 
H. Gender-affirming care information;
I. Reproductive or sexual health information; 
J. Biometric data related to information in paragraphs A to I;
K. Genetic data related to information in paragraphs A to I;
L. Precise location information that could reasonably indicate a consumer's attempt to 
acquire or receive health care services or supplies; or
M. Any information described in paragraphs A to L that is derived or extrapolated from 
nonhealth information, such as proxy, derivative, inferred or emergent data, by any 
means, including algorithms or machine learning.
"Consumer health data" does not include personal information that is used to engage in 
public or peer-reviewed scientific, historical or statistical research in the public interest that 
adheres to all other applicable ethics and privacy laws and is approved, monitored and 
governed by an institutional review board, human subjects research ethics review board or 
a similar independent oversight entity that determines that the regulated entity has 
implemented reasonable safeguards to mitigate privacy risks associated with research, 
including any risks associated with identification.
8. Deceptive design. "Deceptive design" means a user interface designed or 
manipulated with the potential effect of subverting or impairing user autonomy, decision 
making or choice.
9. Deidentified data. "Deidentified data" means data that cannot reasonably be used 
to infer information about, or otherwise be linked to, an identified or identifiable individual, 
or a device linked to such individual, if the regulated entity that possesses such data takes 
reasonable measures to ensure that such data cannot be associated with an individual; 
publicly commits to process such data only in a deidentified form and not attempt to 
reidentify such data; and contractually obligates any recipients of such data to satisfy the  
criteria set forth in this subsection. 
10. Gender-affirming care information. "Gender-affirming care information" means 
personal information relating to seeking or obtaining past, present or future gender-
affirming care services. "Gender-affirming care information" includes, but is not limited 
to:
A. Location information that could reasonably indicate a consumer's attempt to acquire 
or receive gender-affirming care services;
B. Efforts to research or obtain gender-affirming care services; or 
C. Any gender-affirming care information that is derived, extrapolated or inferred, 
including from nonhealth information, such as proxy, derivative, inferred, emergent or 
algorithmic data. 
11. Gender-affirming care services. "Gender-affirming care services" means health 
care services or products that support and affirm an individual's gender identity, including, 
but not limited to, social, psychological, behavioral, cosmetic, medical or surgical 
interventions. "Gender-affirming care services" includes, but is not limited to, treatments 
for gender dysphoria, gender-affirming hormone therapy and gender-affirming surgical 
procedures.
12. Genetic data. "Genetic data" means any data, regardless of its format, that concerns 
a consumer's genetic characteristics. "Genetic data" includes, but is not limited to:
A. Raw sequence data that result from the sequencing of a consumer's complete 
extracted deoxyribonucleic acid, or DNA, or a portion of the extracted DNA;
B. Genotypic and phenotypic information that results from analyzing the raw sequence 
data under paragraph A; and
C. Self-reported health data that a consumer submits to a regulated entity and that is 
analyzed in connection with consumer's raw sequence data under paragraph A.
13. Geofence. "Geofence" means technology that uses global positioning system 
coordinates, cell tower connectivity, cellular data, radio frequency identification, wireless 
access point data or any other form of location detection to establish a virtual perimeter 
around a specific physical location.
14. Health care services. "Health care services" means any services provided to a 
person to assess, measure, improve or learn about a person's health, including, but not 
limited to:
A. Individual health conditions, treatment, status, diseases or diagnoses; 
B. Social, psychological, behavioral and medical interventions; 
C. Noncosmetic surgeries or health-related procedures;
D. Use or purchase of medication;
E. Bodily functions, vital signs, symptoms or measurements described in this 
subsection;
F. Diagnoses or diagnostic testing, treatment or medication; 
G. Reproductive and sexual health services; or
H. Gender-affirming care services.
15. Homepage.  "Homepage" means the introductory page of a publicly accessible 
website and any Internet webpage on which personal information is collected. In the case 
of an online service, such as a mobile application, "homepage" means the application's 
platform page or download page and a link within the application, such as from the 
application's configuration page, "about" page, "information" page or settings page. 
16. Person. "Person" means an individual, corporation, trust, unincorporated 
association or partnership.
17. Personal information. "Personal information" means information that identifies, 
relates to, describes or is reasonably capable of being associated or linked, directly or 
indirectly, with a particular consumer. "Personal information" includes, but is not limited 
to, data associated with a persistent unique identifier, such as a so-called cookie, an Internet 
protocol address or a device identifier.  "Personal information" does not include 
information that is in a public record held by a federal, state or local government. "Personal 
information" includes any biometric data collected about a consumer by a business without 
the consumer's knowledge.  "Personal information" does not include deidentified data. 
18. Process. "Process" means any operation performed on consumer health data.
19. Regulated entity. "Regulated entity" means any person that conducts business in 
this State or produces or provides products or services that are targeted to consumers in this 
State and that collects, shares or sells consumer health data or determines the purpose and 
means of processing consumer health data. "Regulated entity" does not include a 
government agency. 
20. Reproductive or sexual health information. "Reproductive or sexual health 
information" means personal information relating to seeking or obtaining past, present or 
future reproductive or sexual health services. "Reproductive or sexual health information" 
includes, but is not limited to: 
A. Location information that could reasonably indicate a consumer's attempt to acquire 
or receive reproductive or sexual health services;
B. Efforts to research or obtain reproductive or sexual health services; or
C. Any reproductive or sexual health information that is derived, extrapolated or 
inferred, including from nonhealth information, such as proxy, derivative, inferred, 
emergent or algorithmic data.
21. Reproductive or sexual health services. "Reproductive or sexual health services" 
means health services or products that support or relate to an individual's reproductive 
system or sexual well-being, including, but not limited to:
A.  Individual health conditions, treatment, status, diseases or diagnoses; 
B. Social, psychological, behavioral and medical interventions; 
C. Health-related surgeries or procedures, including, but not limited to, abortions;
D. Use or purchase of medication, including, but not limited to, medication for the 
purposes of abortion;
E. Bodily functions, vital signs, symptoms or measurements described in this 
subsection;
F. Diagnoses or diagnostic testing, treatment or medication; and 
G. Medical or nonmedical services related to and provided in conjunction with an 
abortion, including, but not limited to, associated diagnostics, counseling, supplies and 
follow-up services. 
22. Sell or sale. "Sell" or "sale" means, with respect to consumer health data, sharing 
or providing the data for monetary or other valuable consideration.  "Sell" or "sale" does 
not include the sharing of consumer health data for monetary or other valuable 
consideration: 
A. To a 3rd party as an asset that is part of a merger, acquisition, bankruptcy or other 
transaction in which the 3rd party assumes control of all or part of the regulated entity's 
assets;
B. By an individual selling the individual's own consumer health data pursuant to a 
written contract of sale with a 3rd party; or
C. By a regulated entity to a service provider when such sharing is consistent with the 
purpose for which the consumer health data was collected.
23. Service provider. "Service provider" means a person that processes consumer 
health data on behalf of a regulated entity.
24. Share. "Share" means, with respect to consumer health data, the release of, 
disclosure of, dissemination of, divulging of, making available of, providing access to, 
licensing of or otherwise communicating orally, in writing or by electronic or other means, 
consumer health data by a regulated entity to a 3rd party or affiliate.  "Share" does not 
include: 
A. The disclosure of consumer health data by a regulated entity to a service provider 
when such sharing is consistent with the purpose for which the consumer health data 
was collected; 
B. The disclosure of consumer health data to a 3rd party with which the consumer has 
a direct relationship when: 
(1) The disclosure is for purposes of providing a product or service requested by 
the consumer; 
(2) The regulated entity maintains control and ownership of the data; and 
(3) The 3rd party uses the consumer health data only at the direction of the 
regulated entity and consistent with the purpose for which it was collected; or 
C.  The disclosure or transfer of personal data to a 3rd party as an asset that is part of a 
merger, acquisition, bankruptcy or other transaction in which the 3rd party assumes 
control of all or part of the regulated entity's assets.
25. Third party. "Third party" means an entity other than a consumer, regulated entity, 
service provider or affiliate of the regulated entity.
§1350-O. Consumer health data privacy policy
1. Required disclosure. A regulated entity shall maintain a consumer health data 
privacy policy that clearly and conspicuously discloses: 
A. The specific types of consumer health data collected and the purpose for which the 
data is collected, including the specific ways in which the data will be used;
B. The sources from which the consumer health data is collected; 
C. The specific consumer health data that is shared;
D. A list of 3rd parties and affiliates with which the regulated entity shares the 
consumer health data, including an active email address or other online mechanism that 
the consumer may use to contact the 3rd parties and affiliates;
E. The length of time the regulated entity intends to retain each category of consumer 
health data, or, if it is not possible to identify that time frame, the criteria used to 
determine the length of time the regulated entity intends to retain categories of 
consumer health data; and
F. How a consumer can exercise the rights provided in this chapter.
2. Display on homepage. A regulated entity shall prominently publish its consumer 
health data privacy policy on its homepage.
3. Additional categories of data; consent required. A regulated entity may not 
collect, use or share additional categories of consumer health data not disclosed in the 
consumer health data privacy policy without first disclosing the additional categories and 
obtaining the consumer's consent prior to the collection, use or sharing of such consumer 
health data.
4. Use of data for additional purposes; consent required. A regulated entity may 
not collect, use or share consumer health data for purposes not disclosed in the consumer 
health data privacy policy without first disclosing the additional purposes and obtaining the 
consumer's consent prior to the collection, use or sharing of such consumer health data. 
5. Violation. It is a violation of this chapter for a regulated entity to contract with a 
service provider to process consumer health data in a manner that is inconsistent with the 
regulated entity's consumer health data privacy policy.
§1350-P.  Consent to use of consumer health data
A request from a regulated entity to use consumer health data must meet the following 
requirements.
1.  Disclosure.  The request is provided to the consumer in a clear and conspicuous 
stand-alone disclosure made through the primary means used to offer the covered entity's 
product or service, or, if the product or service is not offered in a means that permits the 
making of the request under this paragraph, another means regularly used in conjunction 
with the covered entity's product or service.
2.  Purpose of request.  The request includes a description of the processing purpose 
for which the consumer's consent is sought and:
A.  Clearly states the specific categories of consumer health data that the covered entity 
shall collect, process and transfer necessary to effectuate the processing purpose; and
B.  Includes a prominent heading and is written in easy-to-understand language that 
would enable a reasonable individual to identify and understand the processing purpose 
for which consent is sought and the consumer health data to be collected, processed or 
transferred by the covered entity for that processing purpose.
3.  Consumer rights.  The request clearly explains the consumer's applicable rights 
related to consent.
4.  Accessibility.  The request is made in a manner reasonably accessible to and usable 
by a consumer with a disability.
5.  Language.  The request is made available to the consumer in each language in 
which the covered entity provides a product or service for which authorization is sought.
6.  Option to refuse consent.  The option to refuse consent must be at least as 
prominent as the option to accept, and the option to refuse consent must take the same 
number of steps or fewer as the option to accept.
7.  Affirmative consent for transferring consumer health data.  Processing or 
transferring any consumer health data collected pursuant to the consumer's consent for a 
different processing purpose than that for which the consumer's consent was obtained 
requires the consumer's consent for the subsequent processing purpose.
§1350-Q. Collection and sharing of consumer health data 
1. Collection of consumer health data. A regulated entity may not collect any 
consumer health data except: 
A. With consent from the consumer for such collection for a specified purpose; or
B. To the extent necessary to provide a product or service that the consumer to whom 
the consumer health data relates has requested from the regulated entity.
2. Sharing of consumer health data. A regulated entity may not share any consumer 
health data except:
A. With consent from the consumer for such sharing that is separate and distinct from 
the consent obtained to collect consumer health data; or
B.  To the extent necessary to provide a product or service that the consumer to whom 
the consumer health data relates has requested from the regulated entity.
3. Consent required. Consent required under this section must be obtained prior to the 
collection or sharing, as applicable, of any consumer health data, and the request for 
consent must clearly and conspicuously disclose: 
A. The categories of consumer health data collected or shared; 
B. The purpose of the collection or sharing of the consumer health data, including the 
specific ways in which the data will be used; 
C. The entities with which the consumer health data will be shared; and 
D. How the consumer can withdraw consent from future collection or sharing of the 
consumer's health data.
4. No discrimination for exercise of rights. A regulated entity may not discriminate 
against a consumer for exercising any rights under section 1350-Q.
§1350-R. Consumer rights
1. Rights. A consumer has the following rights with respect to consumer health data 
concerning the consumer.
A. A consumer has the right to confirm whether a regulated entity is collecting or 
sharing consumer health data concerning the consumer and to access the data, 
including a list of all 3rd parties and affiliates with whom or to whom the regulated 
entity has shared or sold the consumer health data and an active e-mail address or other 
online mechanism that the consumer may use to contact these 3rd parties. 
B. A consumer has the right to confirm that a regulated entity has not sold consumer 
health data concerning the consumer. 
C. A consumer has the right to withdraw consent from the regulated entity's collection 
and sharing of consumer health data concerning the consumer.
D. A consumer has the right to have consumer health data concerning the consumer 
deleted and may exercise that right by informing the regulated entity of the consumer's 
request for deletion.
2. Request to delete consumer health data. A regulated entity that receives a 
consumer's request to delete any consumer health data concerning the consumer shall 
without unreasonable delay and no more than 30 calendar days from receiving the deletion 
request:
A. Delete the consumer health data from its records, including from all parts of the 
regulated entity's network or backup systems; and
B. Notify all affiliates, service providers, contractors and other 3rd parties with which 
the regulated entity has shared consumer health data of the deletion request.
All affiliates, service providers, contractors and 3rd parties that receive notice of a 
consumer's deletion request shall honor the consumer's deletion request and delete the 
consumer health data from any possessed records, including from all parts of a network or 
backup system.
3. Exercise of rights. A consumer may exercise the rights set forth in this chapter by 
submitting a request, at any time, to a regulated entity.  A request may be made by a secure 
and reliable method established by the regulated entity and described in its consumer health 
data privacy policy.  The method must take into account the ways in which consumers 
normally interact with the regulated entity, the need for secure and reliable communication 
of such requests and the ability of the regulated entity to authenticate the identity of the 
consumer making the request.  A regulated entity may not require a consumer to create a 
new account in order to exercise consumer rights pursuant to this chapter but may require 
a consumer to use an existing account.
§1350-S. Protection of consumer health data
1. Restriction of access. A regulated entity shall restrict access to consumer health 
data by the employees, service providers and contractors of the regulated entity to only 
those employees, service providers and contractors for which access is necessary to further 
the purposes that are strictly necessary to provide a product or service that the consumer to 
whom the data relates has requested from the regulated entity and for which the consumer 
provided consent.
2. Data security practices. A regulated entity shall establish, implement and maintain 
administrative, technical and physical data security practices that, at a minimum, satisfy a 
reasonable standard of care within the regulated entity's industry to protect the 
confidentiality, integrity and accessibility of consumer health data appropriate to the 
volume and nature of the personal information at issue. 
3.  Disposing of consumer health data; retention schedule.  A regulated entity shall 
dispose of consumer health data in accordance with a retention schedule that requires the 
deletion of consumer health data when the data is required to be deleted by law or is no 
longer necessary for the purpose for which the data was collected, processed or transferred, 
unless an individual has provided consent to such retention.  The disposal of consumer 
health data must include destroying, permanently erasing or otherwise modifying the 
consumer health data to make the data permanently unreadable or indecipherable and 
unrecoverable to ensure ongoing compliance with this section.  A service provider shall 
establish practices to delete or return consumer health data to a regulated entity as requested 
at the end of the provision of services unless retention of the consumer health data is 
required by law.
§1350-T. Requirements for service providers 
1. Processing. A service provider may process consumer health data only pursuant to 
a binding contract between the service provider and the regulated entity that sets forth the 
processing instructions and limits the actions the service provider may take with respect to 
the consumer health data it processes on behalf of the regulated entity. A service provider 
may process consumer health data only in a manner that is consistent with the instructions 
set forth in the binding contract with the regulated entity.
2. Assistance. A service provider shall assist the regulated entity by providing 
appropriate technical and organizational support in fulfilling the regulated entity's 
obligations under this chapter.
3. Failure to adhere to instructions. If a service provider fails to adhere to the 
regulated entity's instructions or processes consumer health data in a manner that is outside 
the scope of the service provider's contract with the regulated entity, the service provider 
is deemed a regulated entity under this chapter and is subject to all the requirements of this 
chapter. 
§1350-U. Sale of consumer health data 
It is unlawful for any person, including, but not limited to, regulated entities or service 
providers, to sell consumer health data. 
§1350-V. Geofence
It is unlawful for any person to implement a geofence around an entity that provides 
in-person health care services when the geofence is used to identify, track, collect data from 
or send notifications or messages to a consumer that enters the virtual perimeter.
§1350-W.  Remedies for violation
1.  Private right of action.  An individual alleging a violation of this chapter may bring 
a civil action against an offending regulated entity.  If the individual prevails in the action, 
the individual is entitled to:
A.  For a violation of this chapter:
(1)  As a result of negligence, actual damages or $1,000 per violation, whichever 
is greater; or
(2)  As a result of recklessness or intentional misconduct, actual damages or $5,000 
per violation, whichever is greater;
B.  Reasonable attorney's fees and court costs, including expert witness fees and other 
litigation expenses; and
C.  Other relief, including injunctive or equitable relief, as the court determines 
appropriate.
2.  Unfair trade practice.  In addition to subsection 1, any violation of this chapter 
constitutes prima facie evidence of a violation of the Maine Unfair Trade Practices Act.
3.  Enforcement by Attorney General.  The Attorney General may bring an action 
against a regulated entity for a violation of this chapter and seek any form of relief available 
to any other plaintiff, including the collection of damages as a civil penalty.
§1350-X. Applicability 
This chapter does not apply to:
1. Protected health information. Protected health information, or information treated 
like protected health information, collected, used or disclosed by covered entities and 
business associates when: 
A. The protected health information is collected, used or disclosed in accordance with 
the federal Health Insurance Portability and Accountability Act of 1996, the Health 
Information Technology for Economic and Clinical Health Act and 45 Code of Federal 
Regulations, Parts 160 and 164 and implementing regulations; and
B. The protected health information is afforded all the privacy protections and security 
safeguards of the federal laws and implementing regulations under paragraph A. For 
the purpose of this subsection, "protected health information," "covered entity" and 
"business associate" have the same meaning as in the federal Health Insurance 
Portability and Accountability Act of 1996 and its implementing regulations;
2. Patient identifying information. Patient identifying information collected, used or 
disclosed in accordance with 42 Code of Federal Regulations, Part 2, established pursuant 
to 42 United States Code, Section 290dd-2; or
3. Health care information.  Health care information collected, used or disclosed in 
accordance with Title 22, section 1711-C.
SUMMARY
This bill establishes consumer rights with regard to consumer health data and defines 
obligations of regulated entities that collect, use and share consumer health data. The bill 
prohibits selling consumer health data and implementing a geofence around certain health 
care entities.  The bill provides a private right of action for a consumer against a regulated 
entity for a violation of the provisions as well as civil penalties and enforcement by the 
Attorney General. The bill also makes violations enforceable under the Maine Unfair Trade 
Practices Act. The bill's requirements do not apply to government agencies and health care 
information subject to federal and state law related to confidentiality of health care 
information.