Testimony on Bill 26-0525, the Personal Health Data Security Amendment Act of 2025

Background:
Bill 26-0525 takes important, targeted steps to establish protections for the personal health data of District residents, including prohibiting geofencing around facilities that provide health services; requiring consent from a person before an entity could sell, offer to sell, collect, or disclose personal health data to a third party; and create a right to deletion period for health data.

Our Position:

While Bill 26-0525 is a strong start, the Committee on Health should make some key changes to strengthen the legislation. This includes ensuring that any HIPAA exemptions are tailored to protected health information, making sure consent cannot be buried in broad terms of service language, and shortening the right to deletion period to 45 days to be in line with other states' deletion requirements.