Missouri hearing considers bill to give patients control over medical records, prompt industry pushback
Loading...
Summary
House Bill 2606 would require informed written consent before health care providers disclose or sell patient records for marketing or research and creates a private right of action with penalties of $1,000–$10,000 per violation; sponsors cite Minnesota's law as a model while hospitals and research institutions warn of operational and research impacts.
Representative Carolyn Caton introduced House Bill 2606 in the House Committee on Health and Mental Health, saying the measure would restore a principle she described as foundational: that "a patient's health information belongs to the patient." The bill would require informed written consent before a health care provider or medical entity may disclose or sell a patient's records for marketing or research, and it creates a private right of action allowing a patient to recover attorney's fees, court costs and damages of at least $1,000 and up to $10,000 per occurrence.
Supporters framed the bill as a privacy and consent reform. "This bill puts patients back in the driver's seat," Matt Flanders, state policy manager for Citizens' Council for Health Freedom, told the committee, arguing that HIPAA operates as a "permissive data sharing rule" in practice and that state law can be more protective. Dr. Gail Wilson, a physician and patient, described personal incidents where records appeared to circulate without clear consent and warned that broad health information networks and the increasing power of AI make de-identified data easier to re-identify.
Opponents, including Rob Monsas for the Missouri Hospital Association and Jacob Scott for the Missouri State Medical Association, urged caution. Monsas said hospitals have statutory reporting duties and quality-improvement programs that rely on data sharing and asked for time to review operational impacts. Scott warned that frequent consent requirements could delay care and create administrative burdens. Sarah Schlemer of Washington University said that WashU's biomedical research depends on large, de-identified datasets and that the bill as drafted could hinder grant-funded research or require substantial additional staff to manage authorizations.
Committee members pressed witnesses on specific interactions with federal requirements. Representative Whaley asked whether the bill "strengthens HIPAA," and the sponsor and witnesses replied that HB 2606 is intended to be compatible but more protective, noting that "wherever there's a specific authorization in law, that information sharing would still be allowed," and that Minnesota law preserves certain exceptions such as a claims database. Witnesses and members repeatedly returned to operational questions: how to handle routine treatment-related data flows (for example, sharing lab results between providers before an intake visit), whether de-identified claims data used by CMS and researchers would still be available, and how IRB-reviewed research would be treated.
The Secretary of State's office asked for an amendment so materials older than 50 years after a patient's death remain available for genealogy and historical research; the sponsor indicated willingness to offer that amendment. Multiple witnesses urged negotiated clarifications to exempt required state or federal reporting (for example, Medicare/CMS submissions), to define how consent forms may be structured for routine treatment-sharing, and to limit unintended consequences for research and EMS quality-improvement data.
The committee did not take a vote; members signaled interest in working with the sponsor and stakeholders to refine definitions of "de-identified" data, carve out statutorily authorized reporting, and specify how consent can be operationalized for routine care. The hearing closed with no formal action recorded.
