Summary
Texas state lawmakers have room for improvement when it comes to making the state welcoming to AI wearables. Texas law includes a number of statutes that place restrictions on the collection and use of data likely to be gathered in the course of AI wearable use. State officials have already enforced some of those statutes against technology companies, indicating that these laws may be a priority among regulators. This focus warrants concern that laws originally intended to address harms unrelated to AI wearable use may be creatively interpreted to nevertheless hinder the adoption of this new technology.
The Texas Medical Records Privacy Act (TMRPA) is an example of the sort of well-intentioned policy that may no longer serve its intended purposes given substantial technological progress. This memo explores those shortcomings and aims to provide lawmakers with a general sense of the questions they should ask and reforms they ought to consider when reviewing out of date laws.
TMRPA expansively defines “covered entities” that perform any of several data activities related to protected health information (PHI). This breadth means that it’s possible that regulators may bring claims against an AI wearable company, despite TMRPA’s original authors never intending to so substantively limit this specific technology.
Background on Wearables
AI wearables, like all computer systems, gather information, process it, and generate outputs. There’s an increasing diversity of such tools but they can be loosely grouped into three categories:
- Biometric wearables focus inward on the wearer’s body. Such devices include continuous glucose monitors, smart rings, and smartwatches. These devices gather information about the user’s body to provide activity and exercise performance metrics, support predictive health insights, and facilitate chronic disease management.
- Auditory wearables look outward rather than looking inward at the user’s body. Some AI wearable products—such as the now-discontinued Humane AI Pin—are worn on the body and use audio as an input, operating via voice commands without a traditional screen. Future consumer AI devices may take similar forms, including pins or necklaces. These are commonly labeled as auditory wearables.
- Visual wearables observe the world around the user. Smart glasses offered by companies such as Ray-Ban Meta and Envision are a prime example of this kind of wearable. These tools often feature one or more integrated cameras and a small screen visible only to the user.
Read more from the Abundance Institute on the state wearable policy landscape here.
The Case for Amending TMRPA
History: The Texas State Legislature determined that HIPAA failed to address its full set of concerns related to PHI and enacted TMRPA in response. It expanded the definition of covered entity, as detailed further below, to include sports teams, accountants, and others that may come into possession of PHI.
But as technology has evolved, TMRPA is not furthering the well-being of Texans. The remainder of this review indicates that the costs have grown as have the missed benefits that could be realized under an alternative approach.
Applicability: TMRPA is excessively broad. TMRPA applies to entities that engage with real or constructive knowledge in the practice of collecting or storing protected health information (PHI). This is a vastly broader scope of covered entities than under HIPAA.
Likewise, PHI is broadly defined as data, including demographic data, that relates to an individual’s past, present, or future physical or mental health condition.
AI wearable companies are almost certainly governed by TMRPA despite it being drafted in response to a different set of technological assumptions. A key feature of AI wearables is their ease of use to collect information throughout the course of the day. Thus, AI wearables may be present and collecting information when a user is attending a doctor appointment and conferring with them about certain symptoms, analyzing their medical data, capturing data from pill bottles, or reviewing health advice. All such encounters may disclose data related to the individual’s health. This data might then be collected, stored, and otherwise processed by the AI wearable company.
Policy Recommendations
The following requirements under TMRPA may apply to AI wearables. These regulatory hurdles were designed to regulate services that were encountered in the doctors office or on a website, not through an always-present AI-powered wearable. Thus, such outdated regulations create unintended consequences for users who rely on wearables for essential tasks and general quality-of-life improvements. Texas state lawmakers should consider amending the TMRPA and related statutes that saddle new companies with outdated obligations.
- Limitations on Disclosure: An AI wearable company may not electronically disclose a user’s PHI to any person unless the company has received “separate authorization” from the individual. This requirement could undermine some of the core benefits of the technology, such as allowing users to more easily share information with loved ones.
- Notice: An AI wearable company must notify users if their collected PHI is subject to electronic disclosure. This requirement may be satisfied by posting a written notice on the company’s website. Though this presents a relatively low technical bar in terms of compliance, it risks adding to the ever-growing list of disclosures on such websites. Individuals may gloss over such notices, undermining the purpose of these laws.
- Training: AI wearable companies must provide training to their employees that covers “state and federal law concerning PHI as necessary and appropriate for the employees to carry out the employees’ duties for the covered entity.”
While AI wearable companies likely already offer training of this sort, they may need to update it to include TMRPA-related guidance. This training obligation also mandates that covered entities update and again provide training upon a “material change in state or federal law concerning PHI.” Additionally, PHI collection is not the purpose nor a predominant use case of many wearables, which also diminishes the likely value of this training.
Penalties: Each violation that is the result of negligence may result in a $5,000 fine. Each violation that is committed knowingly or intentionally may result in a $25,000 fine. TMRPA does not provide a cure period under which companies could be notified of potential violations and take actions to fix any issues.
Upshot
TMRPA is indicative of state laws passed to address harms posed at an earlier time under specific circumstances that will affect AI wearables.
Absent amendments clarifying the intended reach of such laws, AI wearable companies may have to institute burdensome compliance protocols with little benefit, such as training with little to no use to their employees, and otherwise degrade the utility of their tools.
AI wearable companies can and should engage with state legislators to identify how the likely uses of their products do not raise the risks originally targeted by laws such as TMRPA. Policymakers should then weigh that feedback, alongside public input, and pursue the reforms best suited to today’s technology.