As part of the health budget bill signed by Governor Hochul in early May, New York has amended its General Business Law, introducing a prohibition on geofencing of health care facilities that goes into effect on July 2, 2023 – just three weeks before a similar ban in Washington state. This addition to the General Business Law makes it illegal for anyone other than the health care facility itself to establish or use a geofence or similar virtual boundary around any health care facility to (1) deliver digital advertisements to, (2) create profiles of, or (3) make any inferences about the health status, medical condition, or medical treatment of any person at or within the health care facility.
For purposes of the amendment, a health care facility is any public or private entity that provides medical care or related services. This definition explicitly includes hospitals, nursing homes, mental health care facilities, and services provided to individuals with developmental disabilities, but many other types of medical care services may be included in the scope of the definition. The definition also encompasses the building in which any health care facility is located.
Geofencing, according to the definition provided in the amendment, is any technology that allows location detection to establish a virtual boundary around a particular location if that boundary permits a digital advertiser to track location and deliver targeted digital ads to someone entering the geofenced area. This means that, with respect to the geofenced area, you may not let others identify whether a particular person’s device has entered or exited the area or is present in the area based on information, such as the device’s IP address, cell tower connectivity, device ID, wireless access information, or any other form of location data. The area of the prohibited boundary is specified in the amendment as a radius of 1,850 feet, or roughly a third of a mile, from the health care facility. Functionally, most metropolitan areas in the state of New York are unlikely to have enough space between health care facilities, or the buildings housing them, to permit the ready use of geofences. As an example, the radii of health care facilities throughout Manhattan likely overlap across most of the island, potentially affecting the ability of other businesses to deliver targeted digital advertising too.
Compared to similar prohibitions on geofencing in Washington state’s recently passed My Health My Data Act, the New York law’s carve-out for a health care facility’s own geofencing activities is an important distinction. While the New York law allows a facility to use geofencing for its own digital advertising, profiling, and inference development, the Washington geofencing provision applies to any entity or person. The Washington law also restricts a broader range of activities than the New York law, banning the use of geofencing merely to collect health data or send “notifications” or “messages” related to an individual’s health data or health services. The Washington law’s broader prohibitions could limit certain benign use cases that may otherwise improve the patient experience – for example, a service that would permit a health care facility to prompt someone to check in for an appointment upon arrival.
Under both the New York and Washington laws, covered geofencing activities are simply prohibited. Neither law provides for a consent mechanism to allow an individual to opt in to the covered activity. Again, this should have a more limited impact under the New York law, which exempts a health care facility’s own activities, but will severely limit a Washington entity’s ability to use geofencing for certain activities. A final distinction to note is that New York’s law does not include a private right of action, whereas Washington’s law does, creating the added risk of litigation under the stricter of the two new geofencing regimes.
[View source.]
