Sponsor seeks to apply Montana privacy law to mental-health apps, with carve-out for HIPAA-covered telehealth

Representative Katie Sullivan opened a hearing on House Bill 397, which would extend Montana's Uniform Health Care Information Act to a narrowly defined category of "mental health digital services"—mobile apps and websites that collect mental-health or substance-use information, market themselves as such, and use that information to facilitate mental-health services.

"I am here to bring you House Bill 397 which is a law relating to privacy and mental health digital services," Sullivan told the House Health and Human Services Committee. She said the bill is not intended to regulate legitimate telehealth providers already covered by federal HIPAA protections, and she circulated an amendment to make that carve-out explicit.

Proponents included health systems and physician groups that said patients using unregulated apps may not realize their data can be sold or matched with other data sets. Aiden Myhre, representing Billings Clinic and Logan Health, said the sponsor's amendment to exempt HIPAA-covered telehealth was important and urged support. Jean Branscum of the Montana Medical Association said physicians and patients risk exposure when people seek care through apps that are not subject to medical-privacy rules.

Don Cape of the Coalition for Safety and Justice told the committee that unregulated apps can expose highly sensitive data and that consumers often do not understand the privacy limitations of non-HIPAA services. Witnesses and the sponsor emphasized the bill's civil-enforcement model: the Uniform Health Care Information Act already allows the attorney general or a county attorney to bring civil actions and includes remedies ranging from injunctions to fines.

Committee members asked practical questions about enforcement, cross-jurisdictional issues and whether the bill should be broader. Representative Kelly raised concerns about location and enforcement when apps or users rely on virtual private networks or routing that obscures users' locations; Sullivan said the bill targets the app or service that collects and uses the data, not the data pipeline itself. Vice Chair Etcher asked why the bill is limited to mental-health services; Sullivan said she focused on the most egregious category to achieve a workable legislative precedent and expressed openness to future expansion.

Representatives and witnesses agreed on an amendment to explicitly exempt HIPAA-covered telehealth providers; the sponsor said she would work with the committee to refine language. The committee did not vote at the hearing.