SB 2273
HEALTH DATA PRIVACY ACT
TL;DR
Illinois SB 2273, the Health Data Privacy Act, would create new rules for how companies collect, use, and share consumer health data outside of HIPAA's reach. It targets wellness apps, fitness trackers, telehealth platforms, and any business processing health-related information about Illinois residents, including AI systems that infer health status from consumer data.
How This Might Impact Your Business
Companies operating wellness apps, fitness trackers, mental health platforms, and femtech products would need explicit consumer consent before collecting or sharing health data, even data HIPAA does not cover.
AI tools that infer health conditions from non-medical data (search history, purchases, wearables) would fall under the law, affecting ad-tech, retail analytics, and consumer insights firms.
Geofencing around healthcare facilities would be restricted, directly impacting digital advertisers, retail marketers, and location-data brokers serving Illinois consumers.
Businesses would need to publish a consumer health data privacy policy, honor data access and deletion requests, and maintain a clear data-sharing inventory.
Selling health data would require separate, signed authorization from consumers, disrupting current data monetization models for many ad-tech and analytics companies.
Expect a private right of action under Illinois precedent (similar to BIPA), meaning class action exposure with statutory damages per violation.
Currently in committee with no sponsor listed in the available record, so timing and final scope remain uncertain.
What Should You Do
Ask your data and product teams to map every health-adjacent data point you collect from Illinois consumers, including inferences made by AI or ML models.
Have legal review your consent flows, privacy policy, and data-sharing agreements with vendors against Washington's My Health My Data Act, which is the model for this bill.
If you run location-based advertising or analytics, identify any campaigns near hospitals, clinics, pharmacies, or reproductive health facilities in Illinois and prepare to pause them.
Brief your board on potential class action exposure given Illinois's BIPA litigation history, and confirm your cyber and E&O insurance covers health data claims.
Track the bill's movement out of the Assignments Committee and assign someone to monitor amendments, since scope changes are likely before a floor vote.
Who It Affects
Status Timeline
committee
Rule 3-9(a) / Re-referred to Assignments
May 22, 2026