An Act protecting the privacy of social care information

194th Legislature (2025-2026) Introduced by Paul Mark

Mass. Act 93M protects social care data in closed-loop referrals by banning sale/licensing and use beyond the original purpose, with $1,000 penalties and AG enforcement.

House concurred

Summary: An Act Protecting the Privacy of Social Care Information (Senate Docket No. 2264)

Purpose and intent

Introduces a new Chapter 93M to Massachusetts General Laws to protect the privacy of social care information stored in or transmitted through closed-loop referral systems (CLRS).

Aims to prevent the sale, licensing, and inappropriate use of social care information, ensuring data is used only for the purpose for which it was collected or generated.

Key provisions

Definition of terms

Closed-Loop Referral System (CLRS): A system that stores social care information, enables sharing among participating entities for referrals, and can display or update referral activity (including which organizations completed referrals).
Participating organization: Any entity that can create, receive, or update referrals or other social care information in a CLRS (e.g., healthcare providers, health plans, public agencies, charitable/nonprofit organizations, CLRS technology vendors, and entities that provide social care).
Social care: Care, services, goods, or supplies addressing social needs (e.g., housing, food stability, transportation, economic stability, employment, education access, child care, safety).
Social care information: Information related to the need for, payment for, or provision of social care that identifies the person or could reasonably identify the person.

Prohibitions and restrictions (Section 3)

Prohibits selling or licensing social care information stored in or transmitted through a CLRS.
Prohibits using social care information for purposes other than the original purpose for which it was collected or generated.
Imposes a civil penalty of $1,000 for each violation by any entity that sells, offers, licenses, furnishes, provides, or transmits social care information in violation.
Civil penalties are to be collected and enforced by the Attorney General (AG).

Enforcement and administration (Section 4)

The AG may adopt, amend, or repeal rules and regulations necessary to implement, administer, and enforce Chapter 93M.

Effective date (Section 5)

The act takes effect 90 days after enactment.

Who would be affected

Participating organizations in CLRS (including healthcare providers, health plans, public agencies, nonprofits, CLRS technology vendors, and other entities that create, receive, or update social care referrals and information).

Any entity involved in sharing or handling social care information within MA’s CLRS framework would need to comply with the new privacy protections and penalties for noncompliance.

Legislative timeline and status

Introduced: February 27, 2025.

Legislative actions: Referred to the Committee on Consumer Protection and Professional Licensure; House concurred.

Senate Docket: No. 2264; Senate bill companion to Senate No. 258; part of the 2025-2026 session (One Hundred and Ninety-Fourth General Court).

Potential impact and considerations

Strengthens privacy protections for sensitive social care data, aligning with broader data privacy expectations.

Establishes a clear penalty framework to deter improper use and sale of social care information.

Establishes regulatory authority for the AG to implement and enforce the statute.

May impose compliance obligations and costs on entities operating CLRS in Massachusetts.

Implementing regulations will clarify scope, permissible uses, and enforcement procedures consistent with federal and state law.