The Ohio Legislature recently passed a law (Ohio House Bill (HB) 173) restricting how hospitals can engage in targeting advertising and sell personal data. Although Ohio has not yet enacted a comprehensive data privacy law, HB 173’s prohibitions on targeted advertising and the sale of personal data mirror requirements set forth in other states’ data privacy regulations, including the California Consumer Privacy Act. Interestingly, the new Ohio law does not create an exception for these prohibitions based on an end user’s consent. Accordingly, this law may have a significant impact on how hospitals configure their websites to include third-party advertising and analytical tools, and it adds to an already complex issue in light of recent federal guidance and judicial actions regarding use of online tracking technologies. HB 173’s requirements become effective on April 3, 2025.
Background on HB 173
A key focus of HB 173, which Governor Mike DeWine signed into law in January, is to update state requirements for hospitals to publish a consumer-friendly list describing certain charges related to the services and goods they offer patients.
Alternatively, hospitals can fulfill the requirement for a list of standard charges for shoppable services by providing a qualifying internet-based price estimator tool. Hospitals that provide an internet-based price estimator tool have to abide by several requirements, which are nearly identical to those found in the federal Hospital Price Transparency Rule. For instance, the estimator must be free of charge; must not require a user to register or establish a user account or password; and must not require a user to submit personal identifying information, including any information relating to an individual’s health care coverage or other benefits.
New Data Protection Requirements for Ohio Hospitals
HB 173 adopts the following requirements that go beyond the Hospital Price Transparency Rule’s:
- A hospital must not sell personal data acquired from the price estimator tool
- A hospital must not “use, sell, or process personal data” acquired from the tool for the purposes of “targeted advertising,” as defined by the new law
HB 173 defines “targeted advertising” as displaying an advertisement that is selected based on “personal data” obtained through the use of a hospital’s internet-based price estimator tool by a person in Ohio. It explicitly excludes from the definition the following advertising activities:
- Advertising in response to the user’s request for information or feedback
- Advertising based on activities within a hospital’s own websites or online applications
- Advertising based on the context of a user’s current search query, visit to a website, or online application
- Processing personal data solely for measuring or reporting advertising performance, reach, or frequency
For the purposes of the law, “personal data” broadly means any information that is linked or reasonably linkable to an identified or identifiable person in Ohio. It excludes publicly available information and personal data that has been de-identified or aggregated such that no person nor a device linked to that person can be reasonably identified.
Interestingly, the law does not expressly create an exception for these new prohibitions on the sale of data and targeted advertising based on an end user’s consent. Accordingly, although it is common for websites to offer “cookie management tools” that allow an end user to select whether a website deploys third-party advertising cookies, this option does not appear to align with the plain text of HB 173.
Administrative penalties for noncompliance will be imposed at the discretion of the Ohio Director of Health subject to prescribed considerations (i.e., seriousness of violation and demonstration of good faith). The Director of Health will notify hospitals of violations in advance and they will be allowed to address violations via a corrective action plan. Penalties will apply when there is both a violation of the law and a violation of a corrective plan.
Conclusion
When a hospital provides a price estimator tool, it should be aware of and comply with HB 173’s requirements. This includes communicating to its design and product teams the ease-of-use requirements as well as implementing appropriate safeguards to prevent personal data from being inadvertently captured, blocking pixels or other tracking tools from capturing data that can be reasonably linked to a person, and ensuring that any personal data inadvertently captured is not subsequently used for targeted advertising. It is worth noting that the adoption of this new law may indicate that the Ohio Legislature is willing to move forward on enacting a comprehensive consumer privacy law, such as the Ohio Personal Privacy Act (HB 345), which was introduced in 2023.
This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.
This document may be considered attorney advertising in some jurisdictions.
© 2025 THOMPSON HINE LLP. ALL RIGHTS RESERVED.
