Seeking Psychedelics? Check the Data Privacy Clause

Next week, Coloradans will vote on a ballot initiative that, if approved, would create a regulated market for psilocybin in the state. Under this initiative, called Proposition 122, or the Natural Medicine Health Act, psilocybin would be produced in Colorado and administered under supervision at licensed “healing centers.” (Other substances could be added in a few years.) The state would also reduce criminal penalties associated with plants and fungi that produce five psychedelics, allowing them to be cultivated, shared, and consumed at home.

This proposal is arguably the most controversial law in an expanding patchwork of state psychedelic legislation. It has fractured communities in Colorado and beyond, and independent polling suggests voters may be equally divided.

The Prop. 122 campaign says that the initiative will improve the mental health of Coloradans. Research suggests psychedelics could be effective treatments for depression, post-traumatic stress disorder, and substance use conditions. However, therapies approved by the US Food and Drug Administration (FDA) remain years away, and Proposition 122 supporters want to make psychedelics available sooner.

Meanwhile, critics say the campaign is moving too fast. People like Martha Hartney, a Colorado attorney who supports Proposition 122, worry it will produce corporate monopolies like those of state cannabis industries. Denver activists Matthew Duffy and Melanie Rose Rodgers claim out-of-state interests shaped the proposal and funded its campaign without including many Colorado residents, including Black and Indigenous people who were shut out of state cannabis industries. Black and multiracial voters strongly oppose Proposition 122, with over 60 percent saying they’ll reject it, potentially indicating they were not adequately involved in its development.

Vocal debates over Proposition 122 have raised important points on both sides. However, one concern has flown under the radar: the privacy and the surveillance of those who receive psychedelics. And because Colorado’s psychedelic law could become a template for other states, it’s even more important to get psychedelic privacy right.

Federal research and health privacy laws set standards for safety, ethics, and privacy. Some state psychedelic programs, such as those in Texas and Connecticut, dovetail with existing federal policies. Consequently, participants are covered by the Health Insurance Portability and Accountability Act (HIPAA), which safeguards patient information, or the federal Common Rule, which protects people participating in FDA-sanctioned or federally funded research. Published in 1991, the Common Rule outlines basic requirements for obtaining informed consent and ensuring that research proposals comply with ethical standards.

Brett Waters, executive director of Reason for Hope, helped develop the Connecticut law and says its focus on federally sanctioned research was intentional. The bill leverages an existing FDA pathway called expanded access to provide psilocybin and 3,4-Methylenedioxymethamphetamine (MDMA) to veterans, first responders, and health care workers.

In contrast, under Proposition 122, Colorado healing centers will likely fall outside the health care system and skirt federal drug policies and research practices, according to Kayte Spector-Bagdady, a bioethicist, lawyer, and associate director of the Center for Bioethics and Social Sciences in Medicine at the University of Michigan. Spector-Bagdady adds that Proposition 122’s data collection mandate may have more in common with commercial data practices—think Google, Facebook, or 23andMe—which are generally governed by corporate terms of service, privacy policies, and contracts between companies and consumers. Because companies make the rules, they often provide fewer privacy protections.