IL HB3494

Creates the Protect Health Data Privacy Act requiring regulated entities to maintain and publish clear privacy policies disclosing what health data they collect, how it is used, who it is shared with, and retention periods

Prohibits the sale of health data without valid written authorization from the individual that must include specific disclosures, expires after one year, and cannot be a condition of receiving goods or services; sellers and purchasers must retain authorization records for 6 years

Grants individuals the right to confirm whether their health data is being collected, sold, or stored, and the right to request deletion within 45 days; entities must notify third parties of deletion requests

Bans geofencing within 1,750 feet of healthcare facilities for purposes of tracking individuals, collecting data, or sending targeted messages unrelated to requested services

Establishes private right of action with liquidated damages of $1,000 for negligent violations and $5,000 for intentional/reckless violations, plus attorney's fees; Attorney General may also enforce violations under the Consumer Fraud and Deceptive Business Practices Act