Secure Electronic Contact Lens Prescriptions

Summary#

This bill updates part of the Fairness to Contact Lens Consumers Act to require safer electronic handling of contact lens prescriptions. The main changes make online sellers offer a way for people to send a copy of their contact lens prescription electronically under HIPAA privacy rules, require encryption of protected health information sent by email, add email address to seller contact information, and exclude calls made with an artificial or prerecorded voice from a current definition. The broad goal is to modernize how prescriptions are verified and to protect patient data when it is sent electronically.

Key changes:

• Online sellers must provide a method for customers to electronically transmit a copy of their contact lens prescription in a way that meets the HIPAA privacy regulation definition.
• Email encryption required when an online seller sends protected health information (PHI) by email.
• Seller contact info must include an email address in addition to telephone number.
• A call made using an artificial or prerecorded voice is excluded from whatever is defined in the amended subsection (g) (the bill text does not show the full original definition).

What it means for you#

• Online shoppers (people who buy contact lenses):

  • You could be able to upload or transmit your contact lens prescription electronically to an online seller in a manner that is tied to HIPAA rules.
  • If a seller sends your protected health information by email, the bill requires that email to be encrypted.

• Online sellers of contact lenses:

  • Must provide a method that lets customers transmit a copy of their prescription electronically consistent with the HIPAA privacy regulation definition cited in the bill.
  • Must encrypt any PHI they send by email.
  • Must list an email address as part of their required contact information.

• Prescribers (eye care professionals):

  • The bill requires online sellers to accept electronic copies from individuals; it does not change prescribers’ existing obligations in the text shown. How prescribers interact with sellers under the law may be affected in practice but the bill text does not change prescribers’ duties directly.

• General public / regulators:

  • The bill explicitly links electronic prescription transmission to HIPAA privacy rules by reference.
  • The change excluding calls made with artificial or prerecorded voices removes those calls from the scope of the particular definition changed in subsection (g); the bill text does not make clear the practical effect without the full original subsection.

What is unclear:

• The bill amends a specific subsection (g) by excluding artificial or prerecorded voice calls, but the bill text here does not show the full original subsection. It is not clear exactly which types of calls or legal effects this exclusion changes.
• The bill refers to transmission “in accordance with HIPAA privacy regulation” but does not specify technical standards or which party is responsible for meeting every HIPAA requirement.

Expenses#

No publicly available information.

Possible cost implications (inferred from the bill text):

• Online sellers may need to install or upgrade secure systems to accept electronic prescription copies in ways that align with HIPAA definitions. This could mean costs for software, encryption, and staff training.
• Encryption of PHI sent by email may require additional technology or services if not already in place.
• Adding an email address to public contact information is a minimal change.
• The bill text does not include a fiscal note or estimate of enforcement costs for government agencies.

Proponents' View#

The bill appears intended to:

• Modernize prescription verification by allowing electronic transmission rather than relying only on older methods.
• Improve privacy protections by requiring encryption when PHI is emailed.
• Make it easier for consumers to transmit a copy of their contact lens prescription to online sellers.
• Bring contact lens prescription practices into alignment with HIPAA-related privacy expectations by explicit reference.

Opponents' View#

Possible concerns or trade-offs based on the bill text:

• One concern is that complying with HIPAA-related transmission requirements could impose costs and technical burdens on some online sellers, especially small businesses.
• The bill does not spell out technical standards or who must ensure full HIPAA compliance, leaving questions about liability and how sellers should implement secure transmission.
• Excluding artificial or prerecorded voice calls from the amended definition may limit or change automated call options, but the bill text does not explain the intended effect.
• The bill gives limited detail on enforcement, timelines, or penalties for noncompliance, making implementation and oversight unclear.