Massachusetts § 70I - Businesses that electronically store or maintain medical information related to the provision of abortion or abortion-related health care services, in vitro fertilization and gender-affirming health care services; promulgation of regulations; required use of consent form; enforcement and violations; exception

§ 70I. Businesses that electronically store or maintain medical information related to the provision of abortion or abortion-related health care services, in vitro fertilization and gender-affirming health care services; promulgation of regulations; required use of consent form; enforcement and violations; exception

[ Text of section added by 2025, 16, Sec. 12 effective November 5, 2025.]

  Section 70 I . (a) For the purposes of this section, the following words shall have the following meanings unless the context clearly requires otherwise:

  "Abortion'', as defined in section 12K of chapter 112.

  "Abortion-related health care services'', all supplies, care and services of a medical, behavioral health, mental health, surgical, psychiatric, therapeutic, diagnostic, preventative, rehabilitative or supportive nature relating to miscarriage management or the termination of a pregnancy.

  "Business'', (i) a business organized for the purpose of maintaining medical information to make an individual's medical information available to the individual or to a health care provider at the request of the individual or a health care provider, for purposes of allowing the individual or the provider to manage the individual's medical information or for the diagnosis and treatment of the individual;

  (ii) a business that offers medical recordkeeping, electronic health records or electronic medical record services, including, but not limited to, software or hardware, to consumers that makes an individual's medical information available to another person or a health care provider at the request of the individual or a health care provider, for purposes of allowing the other person or the provider to manage the individual's medical information or for the diagnosis, treatment or management of a medical condition of the individual;

  (iii) a business that is licensed by the department or the department of mental health to provide medical, clinical, behavioral or health services; or

  (iv) a business that offers a digital service to a consumer for the purpose of allowing such consumer to manage the consumer's reproductive or sexual health information or for the diagnosis, treatment or management of a reproductive or sexual health medical condition of the consumer.

  "Gender-affirming health care services'', as defined in section 11 I 1/2 of chapter 12.

  (b) A business that electronically stores or maintains medical information related to the provision of abortion or abortion-related health care services, in vitro fertilization and gender-affirming health care services, including, but not limited to, on an electronic health record system or electronic medical record system, on behalf of a health care provider, health care insurance plan, pharmaceutical company, pharmacy benefit manager, contractor or employer, shall develop capabilities, policies and procedures to enable and shall enable features that:

  (i) limit user access privileges to information systems that contain medical information related to abortion or abortion-related health care services, in vitro fertilization and gender-affirming health care services only to those persons who are authorized in writing by the patient to access such medical information;

  (ii) prevent the disclosure, access, transfer, transmission or processing of medical information related to abortion or abortion-related health care services, in vitro fertilization or gender-affirming health care services to persons and entities outside of the commonwealth, absent the express written consent of the patient, independent of any other agreement, that specifically authorizes the disclosure, access, transfer, transmission or processing of such medical information to the named persons or entities outside of the commonwealth; and

  (iii) automatically disable access by individuals and entities outside the commonwealth to segregated medical information related to abortion or abortion-related health care services, in vitro fertilization or gender-affirming health care services, absent the express written consent of the patient that specifically authorizes access by named persons or entities outside of the commonwealth to such segregated medical information.

  (c) The department may promulgate such regulations as may be necessary to implement this section.

  (d) The department shall create a consent form that meets the requirements of this section and shall require its use by all licensed health care providers in the commonwealth.

  (e) The attorney general may bring a civil action for injunctive or other equitable relief to enforce this section. In any action brought by the attorney general under this section, the court may also award a civil penalty of not more than $5,000 per violation.

  (f) A business that discloses, transfers or processes information solely for the purposes of payment, treatment or health care operations, as defined by 45 CFR 164.501, shall not be in violation of this section.