House bill NO. 446

INTRODUCED BY K. Sullivan, D. Zolnikov, D. Harvey, K. Bogner, A. Buckley, K. Kortum

By Request of the ****

A BILL FOR AN ACT ENTITLED: "AN ACT generally revising health privacy laws; establishing confidentiality standards for digital health care; providing for remedies for noncompliance; Providing additional requirements for a mental health digital service; and providing definitions."

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MONTANA:

NEW SECTION. Section 1. Digital health care information -- confidentiality -- penalties -- additional requirements. (1) A mental health digital service is subject to the disclosure and confidentiality provisions of Title 50, chapter 16, part 5, when handling health care information as defined in 50-16-504 on behalf of an individual.

(2)        A violation of this section may be enforced in a civil action as provided in 50-16-552, and a person whose information is disclosed in violation of Title 50, chapter 16, part 5, may pursue the remedies allowed in 50-16-553. A person aggrieved by the sale or purchase of health care information in violation of this section may recover statutory damages of up to $100,000 for each sale or purchase of the health care information in addition to damages for any pecuniary loss under 50-16-553.

(3)        A person who purposely or knowingly sells health care information in violation of this section is guilty of a felony and upon conviction is punishable by imprisonment for a period not exceeding 5 years.

(4)        A person who purposely or knowingly purchases health care information sold in violation of this section is guilty of a felony and upon conviction is punishable by imprisonment for a period not exceeding 5 years.

(5)        If applicable, a prosecutor shall seek extradition of a violator of this section from a foreign country through the United States department of state and the United States department of justice.

(3)(6)     "Mental health digital service" means a mobile-based application or internet website that collects, obtains, uses, possesses, or accesses information related to an individual's inferred or diagnosed mental health or substance use disorder, markets itself as facilitating mental health or substance use disorder services to an individual, and uses the information provided to facilitate mental health services, including diagnosis, treatment, suggested therapies, or management of the mental health or substance use disorder to an individual.

(7)        A mental health digital service that collects health care information of a person in this state must be either incorporated under the laws of this state or registered to do business in the state as a foreign corporation under Title 35, chapter 14.

(8)        A mental health digital service that collects health care information of a person in this state shall file an affirmation with the department of public health and human services that it will comply with the requirements of this section.

NEW SECTION. Section 2. Codification instruction. [Section 1] is intended to be codified as an integral part of Title 50, chapter 16, part 5, and the provisions of Title 50, chapter 16, part 5, apply to [section 1].