Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Digital Privacy topic
No spam. Unsubscribe anytime.
Representative Sullivan seeks to bring mental-health apps under Montana privacy law
Summary
Rep. Katie Sullivan’s HB 397 would apply the Uniform Healthcare Information Act to narrowly defined "mental health digital services" (apps/websites that provide mental-health or substance-use services), exempt HIPAA-covered telehealth, and create civil enforcement options for misuse of sensitive data.
Representative Katie Sullivan on Thursday introduced House Bill 397, asking the House Health and Human Services Committee to apply Montana’s Uniform Healthcare Information Act to a narrowly defined category of mobile and web-based mental-health services that collect, use, or market users' mental-health or substance-use information.
"These apps ... are not covered by federal HIPAA privacy laws or any state privacy laws. They have no obligation to keep these things private and they do not," Sullivan said, describing news reports and research that show sensitive mental-health data can be bought and sold.
Sullivan said the bill does not create a new enforcement scheme but extends an existing Montana civil enforcement pathway: the attorney general or an appropriate county attorney may maintain civil actions and remedies already provided in code. She emphasized a proposed amendment to clarify that legitimate telehealth providers covered by HIPAA are excluded from the new definition.
Supporters included Billings Clinic/Logan Health, the Montana Medical Association and the Coalition for Safety and Justice. Aiden Myhre (Billings Clinic/Logan Health) thanked Sullivan for the telehealth clarification; Don Cape (Coalition for Safety and Justice) warned that processors and data brokers can match and repackage health data across services, creating risks for people who seek online help.
Committee members probed enforcement mechanics: Representative Kelly asked how the state would prove a user is a Montanan if an app’s logs show out-of-state or VPN-located accesses; Sullivan said the bill targets the app operator (not carriers) and that user-supplied demographic or sign-up data would be part of enforcement considerations. Vice Chair Etcher asked why the bill is limited to mental health rather than all wellness apps; Sullivan said she narrowed the scope to get a workable, politically feasible bill and to set precedent for broader privacy protections later.
Representative Sullivan closed by urging the committee to consider the amendment; the committee closed the hearing on HB 397 without taking action at this meeting.
