New Bill Would Bar AI Firms From Selling Health Data
SkimNews Take
By classifying chatbot conversations as protected health data, the bill pulls consumer AI into HIPAA-adjacent territory without touching HIPAA—shifting compliance triggers from what providers collect to what users volunteer.
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Senator Elizabeth Warren and Rep. Mary Gay Scanlon (D-PA) are preparing a revamped Health and Location Data Protection Act that specifically covers data entered into AI systems, expanding a 2022 version that only targeted data brokers' collection and sale of such data.
- The bill would prohibit companies—not just brokers—from selling health and location data to data brokers, and explicitly covers information people share with AI chatbots like ChatGPT and Claude.
- AI labs have aggressively moved into healthcare: Elon Musk publicly urged users to upload medical records to Grok in January, OpenAI launched ChatGPT Health and ChatGPT for Healthcare, and Anthropic shipped Claude for Healthcare as a "HIPAA-ready" tool for individuals, providers, and hospitals.
- University of Illinois law professor Sara Gerke told The Verge that user data protection at AI companies "largely depends on what companies promise in their privacy policies and terms of use," noting the US still lacks a federal data privacy framework.
- The bill—also sponsored by Senators Ron Wyden (D-OR) and Bernie Sanders (I-VT)—would require the FTC to enact implementing rules within 180 days and allow the FTC, state attorneys general, and affected individuals to bring enforcement suits.
- The proposal earmarks $1 billion to the FTC over 10 years specifically for enforcement of the new restrictions on health and location data sales.
Why it matters: The US has no federal data privacy framework, so protection for sensitive health entries into AI chatbots currently "largely depends on what companies promise" in their privacy policies, per University of Illinois law professor Sara Gerke. The bill arms the FTC with $1 billion over 10 years, a 180-day rulemaking deadline, and a private right of action, directly targeting the healthcare push by OpenAI, Anthropic, and xAI.
