New York Assembly Member Felix Ortiz (D-51) has introduced A.B. 1263, legislation which would prohibit "any person from disclosing health care information or personal information to a person who engages in the business of accessing and compiling information for commercial purposes or whose use of such information will be in connection with the marketing of a product or service without the explicit written authorization of the data subject."
“Personal information” is defined as "any individually identifiable information gathered in connection with health care from which judgments can be made about a subject's character, habits, mode of living, avocations, finances, occupation, general reputation, credit, health condition or other personal characteristics.... [and] includes a subject's name, address and telephone number and “medical care information”."
This legislation would effectively expand HIPAA-like restrictions to survey and opinion researchers who are not "covered entities" or "business associates" under HIPAA, with the added cudgel of private rights of action. The sponsor specifically cites concerns about marketing researchers' access to and sharing of confidential health information in the justification for his legislation, so we have little expectation that he would be amenable to excluding marketing research. It would appear that this bill has been introduced and re-introduced since the late nineties and has never been acted upon. MRA will nonetheless seek to defeat A.B. 1263.
Note that Assembly Member Ortiz is no stranger to data privacy issues -- just yesterday, we noted his A.B. 1324.