Consumer Data Privacy Act Passed by Senate, but Dies in House

The Michigan Senate passed the Personal Data Privacy Act (SB 659) along party lines in lame duck session, moving Michigan a step closer to joining the growing ranks of states that have approved comprehensive privacy and data protection legislation. But the legislation didn’t get taken up by the House and died, meaning that the measure is likely to be reintroduced in 2025.

It would, among other provisions, give consumers the right to opt out of the processing of their personal data for targeted advertising, the sale of personal data, and specified profiling activities, as well as confer data rights found in other states’ laws, including rights of access, correction, deletion, and data portability.

MichBio, along with its partner, AdvaMed, advocated long for inclusion of the following exemption: Sec.11 (3): Information included in a Limited Data Set as described at 45 CFR 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified at 45CFR 164.514(e).

That legal speak is a critical inclusion and would permit the transfer of research data between parties and avoid negatively impacting patient care and research and development, especially on the part of medical device manufacturers.

There is no way for medical device manufacturers to tell whether data from certain devices technically falls outside of HIPAA, so all data is treated as though it is protected under HIPAA. The proposed exemption enables medtech companies to continue to support patient care uniformly.

For example, patient data from cardiac monitors used by HCPs who are Covered Recipients under HIPAA is excluded, while patient data from the same model cardiac monitors used by concierge physicians is regulated as health data under this bill with respect to the medtech company even though the company treats data from both devices in the same way.

MichBio and AdvaMed tried to point out that certain consumer rights and regulated entity obligations are inconsistent with how medical devices are utilized in patient care. We expect the bill will be reintroduced in early 2025.