HB 2831

relating to the collection of reproductive health information;
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1.  Chapter 181, Health and Safety Code, is amended
by adding Subchapter F to read as follows:
SUBCHAPTER F.  REPRODUCTIVE HEALTH INFORMATION
Sec. 181.301.  DEFINITIONS.  In this subchapter:
(1)  "Collect" means to obtain, receive, or access in
any manner an individual's reproductive health information,
including by actively or passively receiving information from the
individual or observing or tracking the individual's online
(2)  "Covered entity" means a public or private
business or organization, whether for profit or nonprofit, that
provides reproductive health care, placement, or services and
collects reproductive health information from an individual.  The
term includes a business or organization that licenses or certifies
another person to provide reproductive health care, placement, or
(3)  "Geofence" means technology that uses spatial or
location detection, including global positioning coordinates, cell
tower connectivity, cellular data, radio frequency identification,
or Wi-Fi data, to establish a virtual boundary around a specific
physical location or to locate an individual within a virtual
boundary, provided the virtual boundary is not more than 1,850 feet
from the perimeter of the physical location.
(4)  "Process" means any use of information provided
(5)  "Reproductive health information" means data
reasonably able to identify an individual or the individual's past,
present, or future reproductive health status.  The term does not
(A)  that is used to engage in public or
peer-reviewed scientific, historical, or statistical research
performed in the public interest or authorized and provided for use
under Section 161.021 or 161.022; and
(B)  the use of which adheres to all other
applicable ethics and privacy laws and for which an institutional
review board, a human subjects research ethics board, or a similar
independent oversight entity has approved, monitored, or governed
that use and determined the covered entity or service provider has
implemented reasonable protections to reduce privacy risks
associated with research, including risks associated with
(6)  "Reproductive health services" means health care
services or products supporting or relating to an individual's
reproductive system, pregnancy status, or sexual well-being,
(A)  an individual health condition, status,
(B)  a social, psychological, behavioral, or
(C)  a health-related surgery or procedure,
(D)  a use or purchase of a medication;
(E)  a bodily function, vital sign, symptom, or
measurement related to information described by this subdivision;
(F)  a diagnosis or diagnostic testing,
(G)  a service related to and provided in
conjunction with an abortion, including an associated diagnostic,
counseling, supply, or follow-up service.
(7)  "Reproductive health status" includes the
following data related to an individual's reproductive health,
menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to
conceive, or type of sexual activity:
(A)  an individual health condition, treatment,
(B)  a social, psychological, behavioral, or
(C)  a health-related surgery or procedure,
(D)  a use or purchase of a medication;
(E)  a bodily function, vital sign, symptom, or
measurement related to information described by this subdivision;
(F)  a diagnosis or diagnostic testing,
(G)  data on services related to and provided in
conjunction with an abortion, including an associated diagnostic,
counseling, supply, or follow-up service;
(H)  biometric data generated by automatic
measurements of an individual's biological characteristics,
including a fingerprint, a voiceprint, an eye retina, an iris, or
any other biological pattern or characteristic used to identify a
specific individual, but not including a physical or digital
photograph, a video or audio recording, or any data generated from a
physical or digital photograph or a video or audio recording,
unless the data is generated to identify a specific individual;
(J)  precise location information that may
indicate an individual's attempt to acquire or receive reproductive
(K)  data identifying an individual seeking
reproductive health services or supplies; and
(L)  data a covered entity, or a covered entity's
authorized service provider, processes to associate an individual
with the data described by Paragraphs (A)-(K) that is derived or
extrapolated from non-health information, including proxy,
derivative, inferred, or emergent data, algorithms, and machine
(8)  "Service provider" means a person who collects,
processes, retains, transfers, or sells reproductive health
information for and at the direction of a covered entity.
Sec. 181.302.  COLLECTION AND USE OF REPRODUCTIVE HEALTH
INFORMATION.  (a)  A covered entity or service provider may not
collect or process an individual's reproductive health information
unless the covered entity or service provider:
(1)  provides to the individual a copy of the covered
entity or service provider's privacy policy;
(2)  obtains consent from the individual or the
individual's authorized representative; and
(3)  collects or processes the reproductive health
information only for a purpose described by Subsection (b).
(b)  A covered entity or service provider may only collect or
process an individual's reproductive health information for the
(1)  providing a product, service, or service feature
to the individual who requested the product, service, or service
feature by subscribing to, creating an account with, or otherwise
contracting with the covered entity or service provider;
(2)  initiating, managing, executing, or completing a
financial or commercial transaction or fulfilling an order for a
specific product or service at the individual's request, including
associated administrative, operational, and account servicing
activities, such as billing, shipping, storage, and accounting;
(3)  complying with an obligation under state or
(4)  protecting public safety or public health.
(c)  A covered entity or service provider that collects or
processes reproductive health information may not:
(1)  collect more precise reproductive health
information than is necessary to perform a purpose described by
(2)  retain reproductive health information for longer
than is necessary to perform a purpose described by Subsection (b);
(3)  derive or infer from reproductive health
information any data not necessary to perform a purpose described
(4)  disclose, cause to disclose, assist with the
disclosure of, or facilitate the disclosure of an individual's
reproductive health information to a third party, unless the
(A)  necessary to perform a purpose described by
(B)  performed with the individual's consent
obtained in the manner provided by Section 181.304.
(d)  A covered entity or service provider collecting or
processing reproductive health information must provide a clear and
conspicuous link on the covered entity's or service provider's
Internet website to enable an individual, or a person authorized by
the individual, to request access to and deletion of the
individual's reproductive health information.
(e)  This section does not apply to a covered entity or a
business associate regarding protected health information under
the Health Insurance Portability And Accountability Act and Privacy
(f)  In this section, "business associate" has the meaning
assigned by 45 C.F.R. Section 160.103.
Sec. 181.303.  DISCLOSURE OF INFORMATION TO GOVERNMENTAL
ENTITY OR OFFICIAL.  A covered entity or service provider may not
disclose an individual's reproductive health information to a
federal, state, or local governmental entity or official unless:
(1)  the governmental entity or official serves the
covered entity or service provider with a valid warrant or
establishes the existence of exigent circumstances that render
obtaining a warrant impracticable;
(2)  disclosure is mandated under state or federal law;
(3)  the individual to whom the reproductive health
information pertains requests disclosure.
Sec. 181.304.  OBTAINING CONSENT.  (a)  Consent to collect or
process reproductive health care information under Section 181.302
may be obtained electronically, except consent may not be obtained:
(1)  by a general or broad terms-of-use agreement or a
similar document containing, with other unrelated information,
descriptions of reproductive health information processing;
(2)  by an individual hovering over, muting, pausing,
or not disclosing a given piece of consent information; or
(3)  through the use of a deceptive design.
(b)  In this section, "deceptive design" means an interface
model or choice architecture designed or manipulated with the
intended effect of subverting or impairing user autonomy, decision
making, or choice or unfairly, fraudulently, or deceptively
manipulating or coercing an individual into providing consent.
Sec. 181.305.  SALE OF REPRODUCTIVE HEALTH INFORMATION;
CONSENT.  (a)  A covered entity or service provider may not sell or
offer to sell an individual's reproductive health information
unless the covered entity or service provider obtains the
individual's consent in accordance with Subsections (c) and (d)
before selling or offering to sell the reproductive health
(b)  A covered entity or service provider may not sell or
offer to sell reproductive health information in a manner
inconsistent with the consent obtained under this section.
(c)  Consent provided under this section must be in writing,
be in plain language, and include:
(1)  a description of the individual's specific
reproductive health information the covered entity or service
(2)  the name and contact information of the covered
entity or service provider collecting and selling the reproductive
health information described by Subdivision (1);
(3)  the name and contact information of the person
purchasing the reproductive health information described by
(4)  a description of the purpose for the sale,
including the manner in which the covered entity or service
provider will collect the reproductive health information and the
person purchasing the reproductive health information will use the
(5)  a statement that the provision of goods and
services is not conditioned on the individual signing the consent;
(6)  a statement that the individual has a right to
revoke the individual's consent at any time, and a description of
the procedure for submitting a revocation of the consent;
(7)  a statement that the reproductive health
information sold may be subject to redisclosure by the person
purchasing the reproductive health information and may no longer be
(8)  the signature of the individual providing consent
and the date on which the consent was signed by the individual; and
(9)  an expiration date for the consent, which must be
before the first anniversary of the date the individual signed the
(d)  A covered entity or service provider does not have
consent under this section if the:
(1)  expiration date has passed;
(2)  consent does not contain all information required
(3)  individual has revoked the consent;
(4)  consent has been combined with other documents to
create a compound authorization; or
(5)  provision of goods or services is conditioned on
the individual signing the consent document.
(e)  The covered entity or service provider selling or
offering to sell the reproductive health information shall provide
a copy of the signed, written consent to the individual.
(f)  The covered entity or service provider selling or
offering to sell the reproductive health information and the
purchaser of the reproductive health information shall retain a
copy of the signed, written consent until at least the sixth
anniversary of the later of the date the individual signs the
consent or the last date the consent was in effect.
(g)  A covered entity or service provider that sells
reproductive health information shall provide a clear and
conspicuous link on the covered entity's or service provider's
Internet website to enable an individual, or a person authorized by
the individual, to at any time revoke the individual's consent to
sell reproductive health information.
(h)  A covered entity or service provider selling an
individual's reproductive health information and the purchaser of
the reproductive health information shall enter into a written
agreement governing the purchaser's processing of the individual's
reproductive health information.  The written agreement must:
(1)  legally bind the purchaser and the covered entity
or service provider selling the reproductive health information;
(2)  clearly provide the nature and purpose of the
sale, the type of reproductive health information subject to the
sale, the duration of processing, and the rights and obligations of
(3)  require the purchaser to adhere to the
instructions of the covered entity or service provider;
(4)  establish the extent to which the purchaser may
process the reproductive health information;
(5)  require the purchaser to process the reproductive
health information the purchaser receives from the covered entity
or service provider only to the extent provided for by Subdivision
(6)  require the purchaser to delete or return all
reproductive health information to the covered entity or service
provider at the end of the provision of services or on revocation of
the individual's consent unless retention of the reproductive
health information is required by law.
Sec. 181.306.  GEOFENCING.  A covered entity or service
provider may not implement a geofence around an entity that
provides in-person reproductive health services if the geofence is
(1)  identify or track individuals seeking
(2)  collect reproductive health information from
(3)  send notifications, messages, or advertisements
to individuals related to the individual's reproductive health
information or reproductive health services.
Sec. 181.307.  CAUSE OF ACTION.  (a)  The attorney general
may bring an action to enjoin a violation of this chapter.  On a
proper showing, a court may grant a permanent or temporary
injunction, a restraining order, a writ of mandamus, or any other
order or judgment necessary to enjoin a violation of this
(b)  An individual who suffers harm as a result of a
violation of this subchapter may bring a civil action against the
person who committed the violation to recover:
(1)  damages in an amount of not less than $100 and not
more than $750 per incident or actual damages, whichever is
(2)  injunctive or declaratory relief; or
(3)  any other appropriate relief.
(c)  The court may consider any relevant circumstances in
determining the amount of damages, including:
(1)  the nature and seriousness of the misconduct;
(3)  the persistence of the misconduct;
(4)  the length of time over which the misconduct
(5)  the wilfulness of the defendant's misconduct; or
(6)  the defendant's assets, liabilities, and net
(d)  This subchapter may not be interpreted to create a
private right of action under any other law.  This subsection does
not deprive or relieve a person from any rights, duties, or
obligations imposed under other laws of this state or federal law.
Sec. 181.308.  RULES.  The executive commissioner shall
adopt rules to implement this subchapter.
SECTION 2.  As soon as practicable after the effective date
of this Act, the executive commissioner of the Health and Human
Services Commission shall adopt rules necessary to implement
Subchapter F, Chapter 181, Health and Safety Code, as added by this
SECTION 3.  This Act takes effect September 1, 2025.