By NextBestFitStrong health privacy law
Extend privacy protections to apps and data brokers; strict access logs.
Covers apps and data brokers.
Review ledgerHow this path connects
Addresses
Health privacyThis path
Strong health privacy law
Concrete changes if chosen
What would actually have to change in law, agencies, payment rules, or systems.
- Extend privacy protections to apps and data brokers
Effects
Each effect has its own page: the evidence, the case that it is or isn't a real cost, and whom it affects.
What it fixes
- Health privacy
Extending privacy protections and requiring strict access logs protects patients, including in apps and data brokers that existing health privacy protections miss.
What it creates or worsens
- Leaves less complete or useful data
Extending privacy restrictions to apps and data brokers limits research.
- Adds paperwork, coordination, or complexity
Extended privacy protections and strict access logs bring compliance costs.
Who's affected
Who gains
- People with ongoing or specialist care needs
- Health privacy: Widely shared sensitive health information can expose them to harm.
- People needing mental health care
- Health privacy: Widely shared sensitive health information can expose them to harm.
- Pregnant and postpartum people and infants
- Health privacy: Widely shared sensitive health information can expose them to harm.
- Immigrants and mixed-status families
- Health privacy: Widely shared sensitive health information can expose them to harm.
Who loses
- Health data brokers
- Health privacy: They benefit from health information shared for marketing.
Other ways to soften the losses
- Research exemptions with safeguards
Where it has been tried
- EU GDPR: Under the EU GDPR, French regulator CNIL fined commercial health data broker IQVIA €5 million in 2026 for improperly handling pharmacy and medical records covering tens of millions of individuals without adequate safeguards.