Bill would bring mental‑health apps under Montana privacy law, sponsors say; providers urge narrow carveouts

Representative Katie Sullivan opened a hearing on House Bill 397, a proposal to classify "mental‑health digital services" — mobile apps and web platforms that provide mental‑health or substance‑use support but are not traditional, HIPAA‑covered medical providers — under Montana's Uniform Health Care Information Act.

Sullivan said recent federal enforcement actions and research show some mental‑health apps collect sensitive information and sell or share it outside HIPAA protections. "What we have currently under Montana state law is something called the Uniform Health Care Information Act," she told the committee. "This bill is taking those mental‑health groups, these apps, digital health mental services, and asking them you now are under these Montana Uniform Privacy Act[s]."

Proponents included the Montana Medical Association and consumer and safety groups, who urged the committee to protect users' sensitive data. "Mental health and substance abuse information must be treated with the utmost confidence," said Don Cape of the Coalition for Safety and Justice. Aiden Myhre and others said the sponsor's proposed amendment to clarify that HIPAA‑covered telehealth providers are excluded would address provider concerns.

Committee members questioned enforcement mechanics and scope. Representatives raised whether location spoofing, virtual private networks (VPNs) or interstate hosting would hinder Montana enforcement, and whether to broaden the bill beyond mental‑health apps to other wellness services. Sullivan said she limited the bill to mental‑health digital services intentionally to create a narrower, more winnable policy and proposed a clarifying amendment to exempt legitimate telehealth providers already governed by HIPAA.

The bill would rely on existing state civil enforcement tools: the attorney general or an appropriate county attorney could bring civil actions under the state's Uniform Health Care Information Act; statutory penalties were not changed by the sponsor. The hearing record contains no committee vote.