| 1 | 1 | | |
|---|
| 2 | 2 | | |
|---|
| 3 | 3 | | |
|---|
| 4 | 4 | | |
|---|
| 5 | 5 | | 2025 -- S 0824 |
|---|
| 6 | 6 | | ======== |
|---|
| 7 | 7 | | LC002361 |
|---|
| 8 | 8 | | ======== |
|---|
| 9 | 9 | | S T A T E O F R H O D E I S L A N D |
|---|
| 10 | 10 | | IN GENERAL ASSEMBLY |
|---|
| 11 | 11 | | JANUARY SESSION, A.D. 2025 |
|---|
| 12 | 12 | | ____________ |
|---|
| 13 | 13 | | |
|---|
| 14 | 14 | | A N A C T |
|---|
| 15 | 15 | | RELATING TO HEALTH AND SAFETY -- REPRODUCTIVE FREEDOM AND GENDER |
|---|
| 16 | 16 | | AFFIRMING CARE HEALTH DATA PRIVACY ACT |
|---|
| 17 | 17 | | Introduced By: Senators LaMountain, Lawson, Murray, DiPalma, Gu, Sosnowski, Urso, |
|---|
| 18 | 18 | | Bissaillon, McKenney, and Vargas |
|---|
| 19 | 19 | | Date Introduced: March 14, 2025 |
|---|
| 20 | 20 | | Referred To: Senate Judiciary |
|---|
| 21 | 21 | | |
|---|
| 22 | 22 | | |
|---|
| 23 | 23 | | It is enacted by the General Assembly as follows: |
|---|
| 24 | 24 | | SECTION 1. Title 23 of the General Laws entitled "HEALTH AND SAFETY" is hereby 1 |
|---|
| 25 | 25 | | amended by adding thereto the following chapter: 2 |
|---|
| 26 | 26 | | CHAPTER 101.1 3 |
|---|
| 27 | 27 | | REPRODUCTIVE FREEDOM AND GENDER -AFFIRMING CARE HEALTH DATA 4 |
|---|
| 28 | 28 | | PRIVACY ACT 5 |
|---|
| 29 | 29 | | 23-101.1-1. Title. 6 |
|---|
| 30 | 30 | | This act shall be known and may be cited as the “Reproductive Freedom and Gender-7 |
|---|
| 31 | 31 | | Affirming Care Data Privacy Act.” 8 |
|---|
| 32 | 32 | | 23-101.1-2. Definitions. 9 |
|---|
| 33 | 33 | | As used in this chapter: 10 |
|---|
| 34 | 34 | | (1) "Abortion" means the termination of a pregnancy for purposes other than producing a 11 |
|---|
| 35 | 35 | | live birth. 12 |
|---|
| 36 | 36 | | (2) "Affiliate" means a legal entity that shares common branding with another legal entity 13 |
|---|
| 37 | 37 | | and controls, is controlled by, or is under common control with another legal entity. For the 14 |
|---|
| 38 | 38 | | purposes of this definition, "control" or "controlled" means: 15 |
|---|
| 39 | 39 | | (i) Ownership of, or the power to vote, more than fifty percent (50%) of the outstanding 16 |
|---|
| 40 | 40 | | shares of any class of voting security of a company; 17 |
|---|
| 41 | 41 | | (ii) Control in any manner over the election of a majority of the directors or of individuals 18 |
|---|
| 42 | 42 | | |
|---|
| 43 | 43 | | |
|---|
| 44 | 44 | | LC002361 - Page 2 of 17 |
|---|
| 45 | 45 | | exercising similar functions; or 1 |
|---|
| 46 | 46 | | (iii) The power to exercise controlling influence over the management of a company. 2 |
|---|
| 47 | 47 | | (3) "Authenticate" means to use reasonable means to determine that a request to exercise 3 |
|---|
| 48 | 48 | | any of the rights afforded in this chapter is being made by, or on behalf of, the consumer who is 4 |
|---|
| 49 | 49 | | entitled to exercise such consumer rights with respect to the consumer health data at issue. 5 |
|---|
| 50 | 50 | | (4) "Biometric data" means data that is generated from the measurement or technological 6 |
|---|
| 51 | 51 | | processing of an individual's physiological, biological, or behavioral characteristics and that 7 |
|---|
| 52 | 52 | | identifies a consumer, whether individually or in combination with other data. Biometric data 8 |
|---|
| 53 | 53 | | includes, but is not limited to: 9 |
|---|
| 54 | 54 | | (i) Imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice 10 |
|---|
| 55 | 55 | | recordings, from which an identifier template can be extracted; or 11 |
|---|
| 56 | 56 | | (ii) Keystroke patterns or rhythms and gait patterns or rhythms that contain identifying 12 |
|---|
| 57 | 57 | | information. 13 |
|---|
| 58 | 58 | | (5) "Collect" means to buy, rent, access, retain, receive, acquire, infer, derive, or otherwise 14 |
|---|
| 59 | 59 | | process consumer health data in any manner, including receiving the data from the individual, either 15 |
|---|
| 60 | 60 | | actively or passively, or by observing or tracking the individual’s online activity or precise location. 16 |
|---|
| 61 | 61 | | (6)(i) "Consent" means a clear affirmative act that signifies a consumer's freely given, 17 |
|---|
| 62 | 62 | | specific, informed, opt-in, voluntary, and unambiguous agreement, which may include written 18 |
|---|
| 63 | 63 | | consent provided by electronic means, provided: 19 |
|---|
| 64 | 64 | | (A) The request is provided to the consumer in a clear and conspicuous stand-alone 20 |
|---|
| 65 | 65 | | disclosure; 21 |
|---|
| 66 | 66 | | (B) The request includes a description of the processing purpose for which the consumer’s 22 |
|---|
| 67 | 67 | | consent is sought and clearly states the specific categories of personal data that the regulated entity 23 |
|---|
| 68 | 68 | | intends to collect, process, or transfer; 24 |
|---|
| 69 | 69 | | (C) The request is made available to the consumer in each language in which the regulated 25 |
|---|
| 70 | 70 | | entity provides a product or service for which authorization is sought and, in a manner, reasonably 26 |
|---|
| 71 | 71 | | accessible to consumers with disabilities. 27 |
|---|
| 72 | 72 | | (ii) "Consent" may not be obtained by: 28 |
|---|
| 73 | 73 | | (A) A consumer's acceptance of a general or broad terms of use agreement or a similar 29 |
|---|
| 74 | 74 | | document that contains descriptions of personal data processing along with other unrelated 30 |
|---|
| 75 | 75 | | information; 31 |
|---|
| 76 | 76 | | (B) A consumer hovering over, muting, pausing, or closing a given piece of content; 32 |
|---|
| 77 | 77 | | (C) A consumer's agreement obtained through the use of deceptive designs; or, 33 |
|---|
| 78 | 78 | | (D) Inference from the inaction of a consumer or the consumer’s continued use of a service 34 |
|---|
| 79 | 79 | | |
|---|
| 80 | 80 | | |
|---|
| 81 | 81 | | LC002361 - Page 3 of 17 |
|---|
| 82 | 82 | | or product provided by the regulated entity. 1 |
|---|
| 83 | 83 | | (7) "Consumer" means a natural person who is: 2 |
|---|
| 84 | 84 | | (i) A Rhode Island resident, or a natural person whose consumer health data is collected 3 |
|---|
| 85 | 85 | | while present in Rhode Island; and 4 |
|---|
| 86 | 86 | | (ii) Is acting only in an individual or household context, however identified, including by 5 |
|---|
| 87 | 87 | | any unique identifier. "Consumer" does not include an individual acting in an employment context. 6 |
|---|
| 88 | 88 | | (8) "Consumer health data" means: 7 |
|---|
| 89 | 89 | | (i)(A) A consumer’s gender-affirming care information; 8 |
|---|
| 90 | 90 | | (B) A consumer’s reproductive or sexual health information; or 9 |
|---|
| 91 | 91 | | (ii) Any information that a regulated entity or a small business, or their respective 10 |
|---|
| 92 | 92 | | processor, processes to associate or identify a consumer with the data described in subsection (8)(i) 11 |
|---|
| 93 | 93 | | of this section that is derived or extrapolated from information that is not consumer health data to 12 |
|---|
| 94 | 94 | | include, but not limited to, as proxy, derivative, inferred, or emergent data by any means, including 13 |
|---|
| 95 | 95 | | algorithms or machine learning. 14 |
|---|
| 96 | 96 | | (iii) "Consumer health data" does not include personal information that is used to engage 15 |
|---|
| 97 | 97 | | in public or peer-reviewed scientific, historical, or statistical research in the public interest that 16 |
|---|
| 98 | 98 | | adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed 17 |
|---|
| 99 | 99 | | by an institutional review board, human subjects research ethics review board, or a similar 18 |
|---|
| 100 | 100 | | independent oversight entity that determines that the regulated entity or the small business has 19 |
|---|
| 101 | 101 | | implemented reasonable safeguards to mitigate privacy risks associated with research, including 20 |
|---|
| 102 | 102 | | any risks associated with reidentification. 21 |
|---|
| 103 | 103 | | (9) "Deceptive design" means a user interface designed or manipulated with the effect of 22 |
|---|
| 104 | 104 | | subverting or impairing user autonomy, decision making, or choice. 23 |
|---|
| 105 | 105 | | (10) "Deidentified data" means data that cannot reasonably be used to infer information 24 |
|---|
| 106 | 106 | | about, or otherwise be linked to, an identified or identifiable consumer, or a device linked to such 25 |
|---|
| 107 | 107 | | consumer, if the regulated entity or the small business that possesses such data: 26 |
|---|
| 108 | 108 | | (i) Takes reasonable measures to ensure that such data cannot be associated with a 27 |
|---|
| 109 | 109 | | consumer; 28 |
|---|
| 110 | 110 | | (ii) Publicly commits to process such data only in a deidentified fashion and not attempt to 29 |
|---|
| 111 | 111 | | reidentify such data; and 30 |
|---|
| 112 | 112 | | (iii) Contractually obligates any recipients of such data to satisfy the criteria set forth in 31 |
|---|
| 113 | 113 | | this chapter. 32 |
|---|
| 114 | 114 | | (11) "Gender-affirming care information" means personal information relating to seeking 33 |
|---|
| 115 | 115 | | or obtaining past, present, or future gender-affirming care services. "Gender-affirming care 34 |
|---|
| 116 | 116 | | |
|---|
| 117 | 117 | | |
|---|
| 118 | 118 | | LC002361 - Page 4 of 17 |
|---|
| 119 | 119 | | information" includes, but is not limited to: 1 |
|---|
| 120 | 120 | | (i) Precise location information that could reasonably indicate a consumer's attempt to 2 |
|---|
| 121 | 121 | | acquire or receive gender-affirming care services; 3 |
|---|
| 122 | 122 | | (ii) Efforts to research or obtain gender-affirming care services; or 4 |
|---|
| 123 | 123 | | (iii) Any gender-affirming care information that is derived, extrapolated, or inferred, 5 |
|---|
| 124 | 124 | | including from information that is not consumer health data, such as proxy, derivative, inferred, 6 |
|---|
| 125 | 125 | | emergent, or algorithmic data. 7 |
|---|
| 126 | 126 | | (12) "Gender-affirming care services" means health services or products that support and 8 |
|---|
| 127 | 127 | | affirm an individual's gender identity including, but not limited to, psychological, behavioral, 9 |
|---|
| 128 | 128 | | cosmetic, medical, or surgical interventions. "Gender-affirming care services" includes, but is not 10 |
|---|
| 129 | 129 | | limited to, treatments for gender dysphoria, gender-affirming hormone therapy, and gender-11 |
|---|
| 130 | 130 | | affirming surgical procedures. 12 |
|---|
| 131 | 131 | | (13) "Genetic data" means any data, regardless of its format, that concerns a consumer's 13 |
|---|
| 132 | 132 | | genetic characteristics. "Genetic data" includes, but is not limited to: 14 |
|---|
| 133 | 133 | | (i) Raw sequence data that result from the sequencing of a consumer's complete extracted 15 |
|---|
| 134 | 134 | | deoxyribonucleic acid (DNA) or a portion of the extracted DNA; 16 |
|---|
| 135 | 135 | | (ii) Genotypic and phenotypic information that results from analyzing the raw sequence 17 |
|---|
| 136 | 136 | | data; and 18 |
|---|
| 137 | 137 | | (iii) Self-reported health data that a consumer submits to a regulated entity or a small 19 |
|---|
| 138 | 138 | | business and that is analyzed in connection with consumer's raw sequence data. 20 |
|---|
| 139 | 139 | | (14) "Geofence" means technology that uses global positioning coordinates, cell tower 21 |
|---|
| 140 | 140 | | connectivity, cellular data, radio frequency identification, Wifi data, and/or any other form of 22 |
|---|
| 141 | 141 | | spatial or location detection to establish a virtual boundary around a specific physical location, or 23 |
|---|
| 142 | 142 | | to locate a consumer within a virtual boundary. For purposes of this definition, "geofence" means 24 |
|---|
| 143 | 143 | | a virtual boundary that is two thousand feet (2,000 ft.) or less from the perimeter of the physical 25 |
|---|
| 144 | 144 | | location. 26 |
|---|
| 145 | 145 | | (15) "Health care services" means any service provided to a person to assess, measure, 27 |
|---|
| 146 | 146 | | improve, or learn about a person's mental or physical health including, but not limited to: 28 |
|---|
| 147 | 147 | | (1) Individual health conditions, status, diseases, or diagnoses; 29 |
|---|
| 148 | 148 | | (ii) Psychological, behavioral, and medical interventions; 30 |
|---|
| 149 | 149 | | (iii) Health-related surgeries or procedures; 31 |
|---|
| 150 | 150 | | (iv) Use or purchase of medication; 32 |
|---|
| 151 | 151 | | (v) Bodily functions, vital signs, symptoms, or measurements of the information described 33 |
|---|
| 152 | 152 | | in this subsection; 34 |
|---|
| 153 | 153 | | |
|---|
| 154 | 154 | | |
|---|
| 155 | 155 | | LC002361 - Page 5 of 17 |
|---|
| 156 | 156 | | (vi) Diagnoses or diagnostic testing, treatment, or medication; 1 |
|---|
| 157 | 157 | | (vii) Reproductive health care services; or 2 |
|---|
| 158 | 158 | | (viii) Gender-affirming care services. 3 |
|---|
| 159 | 159 | | (16) "Homepage" means the introductory page of an Internet website and any Internet 4 |
|---|
| 160 | 160 | | webpage where personal information is collected. In the case of an online service, such as a mobile 5 |
|---|
| 161 | 161 | | application, homepage means the application's platform page or download page, and a link within 6 |
|---|
| 162 | 162 | | the application, such as from the application configuration, "about," "information," or settings page. 7 |
|---|
| 163 | 163 | | (17) "Person" means, where applicable, natural persons, corporations, trusts, 8 |
|---|
| 164 | 164 | | unincorporated associations, and partnerships. "Person" does not include government agencies, 9 |
|---|
| 165 | 165 | | tribal nations, or contracted service providers when processing consumer health data on behalf of 10 |
|---|
| 166 | 166 | | a government agency. 11 |
|---|
| 167 | 167 | | (18) "Personal information" means information that identifies or is reasonably capable of 12 |
|---|
| 168 | 168 | | being associated or linked, directly or indirectly, with a particular consumer. "Personal 13 |
|---|
| 169 | 169 | | information" includes, but is not limited to, data associated with a persistent unique identifier, such 14 |
|---|
| 170 | 170 | | as a cookie ID, an IP address, a device identifier, or any other form of persistent unique identifier. 15 |
|---|
| 171 | 171 | | "Personal information" does not include publicly available information or deidentified data. 16 |
|---|
| 172 | 172 | | (19) "Precise location information" means information derived from technology including, 17 |
|---|
| 173 | 173 | | but not limited to, global positioning system level latitude and longitude coordinates or other 18 |
|---|
| 174 | 174 | | mechanisms, that directly identifies the specific location of an individual with precision and 19 |
|---|
| 175 | 175 | | accuracy within a radius of one thousand seven hundred and fifty feet (1,750 ft.). "Precise location 20 |
|---|
| 176 | 176 | | information" does not include the content of communications, or any data generated by or 21 |
|---|
| 177 | 177 | | connected to advanced utility metering infrastructure systems or equipment for use by a utility. 22 |
|---|
| 178 | 178 | | (20) "Process" or "processing" means any operation or set of operations performed on 23 |
|---|
| 179 | 179 | | consumer health data. 24 |
|---|
| 180 | 180 | | (21) "Processor" means a person that processes consumer health data on behalf of a 25 |
|---|
| 181 | 181 | | regulated entity or a small business. 26 |
|---|
| 182 | 182 | | (22) "Publicly available information" means information that: 27 |
|---|
| 183 | 183 | | (i)(A) Is made available through federal, state, or municipal government records or widely 28 |
|---|
| 184 | 184 | | distributed media; 29 |
|---|
| 185 | 185 | | (B) Is released in a disclosure to the general public as required by federal, state, or local 30 |
|---|
| 186 | 186 | | law; or 31 |
|---|
| 187 | 187 | | (C) A regulated entity or a small business has a reasonable basis to believe a consumer has 32 |
|---|
| 188 | 188 | | made available in such a way that the consumer no longer maintains a reasonable expectation of 33 |
|---|
| 189 | 189 | | privacy in the information. 34 |
|---|
| 190 | 190 | | |
|---|
| 191 | 191 | | |
|---|
| 192 | 192 | | LC002361 - Page 6 of 17 |
|---|
| 193 | 193 | | (ii) "Publicly available information" does not include any biometric data collected about a 1 |
|---|
| 194 | 194 | | consumer by a business without the consumer's consent or publicly available information combined 2 |
|---|
| 195 | 195 | | or intermixed with personal information. 3 |
|---|
| 196 | 196 | | (23) "Regulated entity" means any legal entity that: 4 |
|---|
| 197 | 197 | | (i) Provides health care services in Rhode Island, or produces or provides health care 5 |
|---|
| 198 | 198 | | services that are targeted to consumers in Rhode Island; 6 |
|---|
| 199 | 199 | | (ii) Alone or jointly with others, determines the purpose and means of collecting, 7 |
|---|
| 200 | 200 | | processing, sharing, or selling of consumer health data; 8 |
|---|
| 201 | 201 | | (iii) Collects consumer health data directly from consumers. "Regulated entity" does not 9 |
|---|
| 202 | 202 | | mean government agencies, tribal nations, or contracted service providers when processing 10 |
|---|
| 203 | 203 | | consumer health data on behalf of the government agency. 11 |
|---|
| 204 | 204 | | (24) "Reproductive or sexual health information" means personal information relating to 12 |
|---|
| 205 | 205 | | seeking or obtaining past, present, or future reproductive or sexual health services. "Reproductive 13 |
|---|
| 206 | 206 | | or sexual health information" includes, but is not limited to: 14 |
|---|
| 207 | 207 | | (i) Precise location information that could reasonably indicate a consumer's attempt to 15 |
|---|
| 208 | 208 | | acquire or receive reproductive or sexual health services; 16 |
|---|
| 209 | 209 | | (ii) Efforts to research or obtain reproductive or sexual health services; or 17 |
|---|
| 210 | 210 | | (iii) Any reproductive or sexual health information that is derived, extrapolated, or inferred, 18 |
|---|
| 211 | 211 | | including from nonhealth information (such as proxy, derivative, inferred, emergent, or algorithmic 19 |
|---|
| 212 | 212 | | data). 20 |
|---|
| 213 | 213 | | (25) "Reproductive or sexual health services" means health services or products that 21 |
|---|
| 214 | 214 | | support or relate to a consumer's reproductive system or sexual well-being including, but not limited 22 |
|---|
| 215 | 215 | | to: 23 |
|---|
| 216 | 216 | | (i) Individual health conditions, status, diseases, or diagnoses; 24 |
|---|
| 217 | 217 | | (ii) Psychological, behavioral, and medical interventions; 25 |
|---|
| 218 | 218 | | (iii) Health-related surgeries or procedures including, but not limited to, abortions; 26 |
|---|
| 219 | 219 | | (iv) Use or purchase of medication including, but not limited to, medications for the 27 |
|---|
| 220 | 220 | | purposes of abortion; 28 |
|---|
| 221 | 221 | | (v) Bodily functions, vital signs, symptoms, or measurements of the information described 29 |
|---|
| 222 | 222 | | in this subsection; 30 |
|---|
| 223 | 223 | | (vi) Diagnoses or diagnostic testing, treatment, or medication; and 31 |
|---|
| 224 | 224 | | (vii) Medical or nonmedical services related to and provided in conjunction with an 32 |
|---|
| 225 | 225 | | abortion including, but not limited to, associated diagnostics, counseling, supplies, and follow-up 33 |
|---|
| 226 | 226 | | services. 34 |
|---|
| 227 | 227 | | |
|---|
| 228 | 228 | | |
|---|
| 229 | 229 | | LC002361 - Page 7 of 17 |
|---|
| 230 | 230 | | (26)(i) "Sell" or "sale" means the exchange of consumer health data for monetary or other 1 |
|---|
| 231 | 231 | | valuable consideration. 2 |
|---|
| 232 | 232 | | (ii) "Sell" or "sale" does not include the exchange of consumer health data for monetary or 3 |
|---|
| 233 | 233 | | other valuable consideration: 4 |
|---|
| 234 | 234 | | (A) To a third party as an asset that is part of a merger, acquisition, bankruptcy, or other 5 |
|---|
| 235 | 235 | | transaction in which the third party assumes control of all or part of the regulated entity's or the 6 |
|---|
| 236 | 236 | | small business's assets that complies with the requirements and obligations in this chapter, but only 7 |
|---|
| 237 | 237 | | if the regulated entity, in a reasonable time before the exchange, provides the affected consumer 8 |
|---|
| 238 | 238 | | with both of the following: 9 |
|---|
| 239 | 239 | | (I) A notice describing the transfer, including the name of the entity receiving the 10 |
|---|
| 240 | 240 | | individual's consumer health data and the applicable privacy policies of the entity; and 11 |
|---|
| 241 | 241 | | (II) A reasonable opportunity to withdraw previously provided consent related to the 12 |
|---|
| 242 | 242 | | individual's consumer health data and request the deletion of the individual's consumer health data; 13 |
|---|
| 243 | 243 | | or 14 |
|---|
| 244 | 244 | | (B) By a regulated entity or a small business to a processor when such exchange is 15 |
|---|
| 245 | 245 | | consistent with the purpose for which the consumer health data was collected and disclosed to the 16 |
|---|
| 246 | 246 | | consumer. 17 |
|---|
| 247 | 247 | | (C) If the exchange is of publicly available information. 18 |
|---|
| 248 | 248 | | (27)(i) "Share" or "sharing" means to release, disclose, disseminate, divulge, make 19 |
|---|
| 249 | 249 | | available, provide access to, license, or otherwise communicate orally, in writing, or by electronic 20 |
|---|
| 250 | 250 | | or other means, consumer health data by a regulated entity or a small business to a third party or 21 |
|---|
| 251 | 251 | | affiliate. “Share” includes “sell.” 22 |
|---|
| 252 | 252 | | (ii) The term "share" or "sharing" does not include: 23 |
|---|
| 253 | 253 | | (A) The disclosure of consumer health data by a regulated entity or a small business to a 24 |
|---|
| 254 | 254 | | processor when such sharing is to provide goods or services in a manner consistent with the purpose 25 |
|---|
| 255 | 255 | | for which the consumer health data was collected and disclosed to the consumer; 26 |
|---|
| 256 | 256 | | (B) The disclosure of consumer health data to a third party with whom the consumer has a 27 |
|---|
| 257 | 257 | | direct relationship when: 28 |
|---|
| 258 | 258 | | (I) The disclosure is for purposes of providing a product or service requested by the 29 |
|---|
| 259 | 259 | | consumer; 30 |
|---|
| 260 | 260 | | (II) The regulated entity or the small business maintains control and ownership of the data; 31 |
|---|
| 261 | 261 | | and 32 |
|---|
| 262 | 262 | | (III) The third party uses the consumer health data only at direction from the regulated 33 |
|---|
| 263 | 263 | | entity or the small business and consistent with the purpose for which it was collected and consented 34 |
|---|
| 264 | 264 | | |
|---|
| 265 | 265 | | |
|---|
| 266 | 266 | | LC002361 - Page 8 of 17 |
|---|
| 267 | 267 | | to by the consumer; or 1 |
|---|
| 268 | 268 | | (C) The disclosure or transfer of personal data to a third party as an asset that is part of a 2 |
|---|
| 269 | 269 | | merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all 3 |
|---|
| 270 | 270 | | or part of the regulated entity's or the small business's assets and complies with the requirements 4 |
|---|
| 271 | 271 | | and obligations in this chapter. 5 |
|---|
| 272 | 272 | | (28) "Small business" means a regulated entity that satisfies one or both of the following 6 |
|---|
| 273 | 273 | | thresholds: 7 |
|---|
| 274 | 274 | | (i) Collects, processes, sells, or shares consumer health data of fewer than one hundred 8 |
|---|
| 275 | 275 | | thousand (100,000) consumers during a calendar year; or 9 |
|---|
| 276 | 276 | | (b) Derives less than fifty percent (50%) of gross revenue from the collection, processing, 10 |
|---|
| 277 | 277 | | selling, or sharing of consumer health data, and controls, processes, sells, or shares consumer health 11 |
|---|
| 278 | 278 | | data of fewer than twenty-five thousand (25,000) consumers. 12 |
|---|
| 279 | 279 | | (29) "Third party" means an entity other than a consumer, regulated entity, processor, small 13 |
|---|
| 280 | 280 | | business, or affiliate of the regulated entity or the small business. 14 |
|---|
| 281 | 281 | | 23-101.1-3. Consumer health data privacy policy. 15 |
|---|
| 282 | 282 | | (a)(1) A regulated entity, by January 1, 2026, and a small business, by April 1, 2026, shall 16 |
|---|
| 283 | 283 | | maintain a consumer health data privacy policy that clearly and conspicuously discloses: 17 |
|---|
| 284 | 284 | | (i) The categories of consumer health data collected and the purpose for which the data is 18 |
|---|
| 285 | 285 | | collected, including how the data will be used; 19 |
|---|
| 286 | 286 | | (ii) The categories of sources from which the consumer health data is collected; 20 |
|---|
| 287 | 287 | | (iii) The categories of consumer health data that is shared; 21 |
|---|
| 288 | 288 | | (iv) A list of the categories of third parties and specific affiliates with whom the regulated 22 |
|---|
| 289 | 289 | | entity or the small business shares the consumer health data; and 23 |
|---|
| 290 | 290 | | (v) How a consumer can exercise the rights provided in § 23-101.1-5. 24 |
|---|
| 291 | 291 | | (2) A regulated entity and a small business shall prominently publish a link to its consumer 25 |
|---|
| 292 | 292 | | health data privacy policy on its homepage. 26 |
|---|
| 293 | 293 | | (3) A regulated entity or a small business may not collect, use, or share additional 27 |
|---|
| 294 | 294 | | categories of consumer health data not disclosed in the consumer health data privacy policy without 28 |
|---|
| 295 | 295 | | first disclosing the additional categories and obtaining the consumer's affirmative consent prior to 29 |
|---|
| 296 | 296 | | the collection, use, or sharing of such consumer health data. 30 |
|---|
| 297 | 297 | | (4) A regulated entity or a small business may not collect, use, or share consumer health 31 |
|---|
| 298 | 298 | | data for additional purposes not disclosed in the consumer health data privacy policy without first 32 |
|---|
| 299 | 299 | | disclosing the additional purposes and obtaining the consumer's affirmative consent prior to the 33 |
|---|
| 300 | 300 | | collection, use, or sharing of such consumer health data. 34 |
|---|
| 301 | 301 | | |
|---|
| 302 | 302 | | |
|---|
| 303 | 303 | | LC002361 - Page 9 of 17 |
|---|
| 304 | 304 | | (5) It is a violation of this chapter for a regulated entity or a small business to contract with 1 |
|---|
| 305 | 305 | | a processor to process consumer health data in a manner that is inconsistent with the regulated 2 |
|---|
| 306 | 306 | | entity's or the small business's consumer health data privacy policy. 3 |
|---|
| 307 | 307 | | 23-101.1-4. Collection or sharing of consumer health data. 4 |
|---|
| 308 | 308 | | (a)(1) A regulated entity, by January 1, 2026, and a small business, by April 1, 2026, shall 5 |
|---|
| 309 | 309 | | not collect or share any consumer health data, including the sale of consumer health data, except: 6 |
|---|
| 310 | 310 | | (i) With consent from the consumer for such collection for a specified purpose; and 7 |
|---|
| 311 | 311 | | (ii) If the consumer health data is collected or shared only for one or more of the following 8 |
|---|
| 312 | 312 | | permissible purposes: 9 |
|---|
| 313 | 313 | | (A) As necessary to provide a product, service, or service feature to the individual to whom 10 |
|---|
| 314 | 314 | | the consumer health data pertains when requested by that individual. 11 |
|---|
| 315 | 315 | | (B) To initiate, manage, execute, or complete a financial or commercial transaction or to 12 |
|---|
| 316 | 316 | | fulfill an order for a specific product or service requested by an individual to whom the consumer 13 |
|---|
| 317 | 317 | | health data pertains including, but not limited to, associated routine administrative, operational, and 14 |
|---|
| 318 | 318 | | account servicing activity such as billing, shipping, storage, and accounting. 15 |
|---|
| 319 | 319 | | (C) To comply with an obligation under a law of this state or federal law. 16 |
|---|
| 320 | 320 | | (D) To protect public safety or public health. 17 |
|---|
| 321 | 321 | | (E) To prevent, detect, protect against, or respond to a security incident, identity theft, 18 |
|---|
| 322 | 322 | | fraud, harassment, malicious or deceptive activities, or activities that are illegal under the laws of 19 |
|---|
| 323 | 323 | | this state. 20 |
|---|
| 324 | 324 | | (F) To preserve the integrity or security of systems. 21 |
|---|
| 325 | 325 | | (G) To investigate, report, or prosecute persons responsible for activities that are illegal 22 |
|---|
| 326 | 326 | | under the laws of this state. 23 |
|---|
| 327 | 327 | | (2) Consent required under this section shall be obtained prior to the collection or sharing, 24 |
|---|
| 328 | 328 | | as applicable, of any consumer health data, and the request for consent shall clearly and 25 |
|---|
| 329 | 329 | | conspicuously disclose: 26 |
|---|
| 330 | 330 | | (i) The categories of consumer health data collected or shared; 27 |
|---|
| 331 | 331 | | (ii) The purpose of the collection or sharing of the consumer health data, including the 28 |
|---|
| 332 | 332 | | specific ways in which it will be used; 29 |
|---|
| 333 | 333 | | (iii) The categories of entities with whom the consumer health data is shared; and 30 |
|---|
| 334 | 334 | | (iv) How the consumer can withdraw consent from future collection or sharing of the 31 |
|---|
| 335 | 335 | | consumer's health data. 32 |
|---|
| 336 | 336 | | (3) A regulated entity or a small business shall not unlawfully discriminate against a 33 |
|---|
| 337 | 337 | | consumer for exercising any rights included in this chapter. 34 |
|---|
| 338 | 338 | | |
|---|
| 339 | 339 | | |
|---|
| 340 | 340 | | LC002361 - Page 10 of 17 |
|---|
| 341 | 341 | | 23-101.1-5. Consumer rights and requests -- Refusal -- Appeal. 1 |
|---|
| 342 | 342 | | (a)(1) A consumer has the right to confirm whether a regulated entity or a small business 2 |
|---|
| 343 | 343 | | is collecting, sharing, or selling consumer health data concerning the consumer and to access such 3 |
|---|
| 344 | 344 | | data, including a list of all third parties and affiliates with whom the regulated entity or the small 4 |
|---|
| 345 | 345 | | business has shared or sold the consumer health data and an active email address or other online 5 |
|---|
| 346 | 346 | | mechanism that the consumer may use to contact these third parties. 6 |
|---|
| 347 | 347 | | (2) A consumer has the right to withdraw consent from the regulated entity's or the small 7 |
|---|
| 348 | 348 | | business's collection and sharing of consumer health data concerning the consumer. 8 |
|---|
| 349 | 349 | | (3) A consumer has the right to have consumer health data concerning the consumer deleted 9 |
|---|
| 350 | 350 | | and may exercise that right by informing the regulated entity or the small business of the consumer's 10 |
|---|
| 351 | 351 | | request for deletion. 11 |
|---|
| 352 | 352 | | (i) A regulated entity or a small business that receives a consumer's request to delete any 12 |
|---|
| 353 | 353 | | consumer health data concerning the consumer shall: 13 |
|---|
| 354 | 354 | | (A) Delete the consumer health data from its records, including from all parts of the 14 |
|---|
| 355 | 355 | | regulated entity's or the small business's network, including archived or backup systems pursuant 15 |
|---|
| 356 | 356 | | subsection (a)(3)(B)(iii) of this section; and 16 |
|---|
| 357 | 357 | | (B) Notify all affiliates, processors, contractors, and other third parties with whom the 17 |
|---|
| 358 | 358 | | regulated entity or the small business has shared consumer health data of the deletion request. 18 |
|---|
| 359 | 359 | | (ii) All affiliates, processors, contractors, and other third parties that receive notice of a 19 |
|---|
| 360 | 360 | | consumer's deletion request shall honor the consumer's deletion request and delete the consumer 20 |
|---|
| 361 | 361 | | health data from its records, subject to the requirements of this chapter. 21 |
|---|
| 362 | 362 | | (iii) If consumer health data that a consumer requests to be deleted is stored on archived or 22 |
|---|
| 363 | 363 | | backup systems, then the request for deletion may be delayed to enable restoration of the archived 23 |
|---|
| 364 | 364 | | or backup systems; provided that, such delay may not exceed six (6) months from authenticating 24 |
|---|
| 365 | 365 | | the deletion request. 25 |
|---|
| 366 | 366 | | (4) A consumer may exercise the rights set forth in this chapter by submitting a request, at 26 |
|---|
| 367 | 367 | | any time, to a regulated entity or a small business. Such a request may be made by a secure and 27 |
|---|
| 368 | 368 | | reliable means established by the regulated entity or the small business and described in its 28 |
|---|
| 369 | 369 | | consumer health data privacy policy. The method shall take into account the ways in which 29 |
|---|
| 370 | 370 | | consumers normally interact with the regulated entity or the small business, the need for secure and 30 |
|---|
| 371 | 371 | | reliable communication of such requests, and the ability of the regulated entity or the small business 31 |
|---|
| 372 | 372 | | to authenticate the identity of the consumer making the request. A regulated entity or a small 32 |
|---|
| 373 | 373 | | business shall not require a consumer to create a new account in order to exercise consumer rights 33 |
|---|
| 374 | 374 | | pursuant to this chapter but may require a consumer to use an existing account. 34 |
|---|
| 375 | 375 | | |
|---|
| 376 | 376 | | |
|---|
| 377 | 377 | | LC002361 - Page 11 of 17 |
|---|
| 378 | 378 | | (5) If a regulated entity or a small business is unable to authenticate the request using 1 |
|---|
| 379 | 379 | | commercially reasonable efforts, the regulated entity or the small business shall not be required to 2 |
|---|
| 380 | 380 | | comply with a request to initiate an action under this section and may request that the consumer 3 |
|---|
| 381 | 381 | | provide additional information reasonably necessary to authenticate the consumer and the 4 |
|---|
| 382 | 382 | | consumer's request. 5 |
|---|
| 383 | 383 | | (6) Information provided in response to a consumer request shall be provided by a regulated 6 |
|---|
| 384 | 384 | | entity and a small business free of charge, up to twice annually per consumer. If requests from a 7 |
|---|
| 385 | 385 | | consumer are manifestly unfounded, excessive, or repetitive, the regulated entity or the small 8 |
|---|
| 386 | 386 | | business may charge the consumer a reasonable fee to cover the administrative costs of complying 9 |
|---|
| 387 | 387 | | with the request or decline to act on the request. The regulated entity and the small business bear 10 |
|---|
| 388 | 388 | | the burden of demonstrating the manifestly unfounded, excessive, or repetitive nature of the 11 |
|---|
| 389 | 389 | | request. 12 |
|---|
| 390 | 390 | | (7) A regulated entity and a small business shall comply with the consumer's requests under 13 |
|---|
| 391 | 391 | | subsection (a)(1) through (a)(3) of this section within forty-five (45) days of receipt of the request 14 |
|---|
| 392 | 392 | | submitted pursuant to the methods described in this section. A regulated entity and a small business 15 |
|---|
| 393 | 393 | | shall promptly take steps to authenticate a consumer request, but this does not extend the regulated 16 |
|---|
| 394 | 394 | | entity's and the small business's duty to comply with the consumer's request within forty-five (45) 17 |
|---|
| 395 | 395 | | days of receipt of the consumer's request. The response period may be extended once by forty-five 18 |
|---|
| 396 | 396 | | (45) additional days when reasonably necessary, taking into account the complexity and number of 19 |
|---|
| 397 | 397 | | the consumer's requests, so long as the regulated entity or the small business informs the consumer 20 |
|---|
| 398 | 398 | | of any such extension within the initial forty-five (45)-day response period, together with the reason 21 |
|---|
| 399 | 399 | | for the extension. 22 |
|---|
| 400 | 400 | | (b) A regulated entity shall comply with this section by January 1, 2026, and a small 23 |
|---|
| 401 | 401 | | business shall comply with this section beginning April 1, 2026. 24 |
|---|
| 402 | 402 | | 23-101.1-6. Data security practices. 25 |
|---|
| 403 | 403 | | A regulated entity, by January 1, 2026, and a small business, by April 1, 2026, shall: 26 |
|---|
| 404 | 404 | | (1) Restrict access to consumer health data by the employees, processors, and contractors 27 |
|---|
| 405 | 405 | | of such regulated entity or small business to only those employees, processors, and contractors for 28 |
|---|
| 406 | 406 | | which access is necessary to further the purposes for which the consumer provided consent or where 29 |
|---|
| 407 | 407 | | necessary to provide a product or service that the consumer to whom such consumer health data 30 |
|---|
| 408 | 408 | | relates has requested from such regulated entity or small business; and 31 |
|---|
| 409 | 409 | | (2) Establish, implement, and maintain administrative, technical, and physical data security 32 |
|---|
| 410 | 410 | | practices that, at a minimum, satisfy reasonable standard of care within the regulated entity's or the 33 |
|---|
| 411 | 411 | | small business's industry to protect the confidentiality, integrity, and accessibility of consumer 34 |
|---|
| 412 | 412 | | |
|---|
| 413 | 413 | | |
|---|
| 414 | 414 | | LC002361 - Page 12 of 17 |
|---|
| 415 | 415 | | health data appropriate to the volume and nature of the consumer health data at issue. 1 |
|---|
| 416 | 416 | | 23-101.1-7. Processors. 2 |
|---|
| 417 | 417 | | (a)(1) Effective January 1, 2026 for a regulated entity, and April 1, 2026 for a small 3 |
|---|
| 418 | 418 | | business, a processor may process consumer health data only pursuant to a binding contract 4 |
|---|
| 419 | 419 | | between the processor and the regulated entity or the small business that sets forth the processing 5 |
|---|
| 420 | 420 | | instructions and limit the actions the processor may take with respect to the consumer health data 6 |
|---|
| 421 | 421 | | it processes on behalf of the regulated entity or the small business. 7 |
|---|
| 422 | 422 | | (2) A processor may process consumer health data only in a manner that is consistent with 8 |
|---|
| 423 | 423 | | the binding instructions set forth in the contract with the regulated entity or the small business. 9 |
|---|
| 424 | 424 | | (b) A processor shall assist the regulated entity or the small business by appropriate 10 |
|---|
| 425 | 425 | | technical and organizational measures, insofar as this is possible, in fulfilling the regulated entity's 11 |
|---|
| 426 | 426 | | and the small business's obligations under this chapter. 12 |
|---|
| 427 | 427 | | (c) If a processor fails to adhere to the regulated entity's or the small business's instructions 13 |
|---|
| 428 | 428 | | or processes consumer health data in a manner that is outside the scope of the processor's contract 14 |
|---|
| 429 | 429 | | with the regulated entity or the small business, the processor is considered a regulated entity or a 15 |
|---|
| 430 | 430 | | small business with regard to such data and is subject to all the requirements of this chapter with 16 |
|---|
| 431 | 431 | | regard to such data. 17 |
|---|
| 432 | 432 | | 23-101.1-8. Valid authorization to sell -- Defects -- Provision to consumer. 18 |
|---|
| 433 | 433 | | (a) Subject to the requirements of § 23-101.1-4, by January 1, 2026 for a regulated entity 19 |
|---|
| 434 | 434 | | and April 1, 2026 for a small business, it is unlawful for any person to sell or offer to sell consumer 20 |
|---|
| 435 | 435 | | health data concerning a consumer without first obtaining valid authorization from the consumer. 21 |
|---|
| 436 | 436 | | The sale of consumer health data shall be consistent with the valid authorization signed by the 22 |
|---|
| 437 | 437 | | consumer. This authorization shall be separate and distinct from the consent obtained to collect or 23 |
|---|
| 438 | 438 | | share consumer health data, as required under § 23-101.1-4. 24 |
|---|
| 439 | 439 | | (b) A valid authorization to sell consumer health data is a document consistent with this 25 |
|---|
| 440 | 440 | | section and shall be written in plain language. The valid authorization to sell consumer health data 26 |
|---|
| 441 | 441 | | shall contain the following: 27 |
|---|
| 442 | 442 | | (1) The specific consumer health data concerning the consumer that the person intends to 28 |
|---|
| 443 | 443 | | sell; 29 |
|---|
| 444 | 444 | | (2) The name and contact information of the person collecting and selling the consumer 30 |
|---|
| 445 | 445 | | health data; 31 |
|---|
| 446 | 446 | | (3) The name and contact information of the person purchasing the consumer health data 32 |
|---|
| 447 | 447 | | from the seller identified in subsection (b)(2) of this section; 33 |
|---|
| 448 | 448 | | (4) A description of the purpose for the sale, including how the consumer health data shall 34 |
|---|
| 449 | 449 | | |
|---|
| 450 | 450 | | |
|---|
| 451 | 451 | | LC002361 - Page 13 of 17 |
|---|
| 452 | 452 | | be gathered and how it will be used by the purchaser identified in subsection (b)(3) of this section 1 |
|---|
| 453 | 453 | | when sold; 2 |
|---|
| 454 | 454 | | (5) A statement that the provision of goods or services may not be conditioned on the 3 |
|---|
| 455 | 455 | | consumer signing the valid authorization; 4 |
|---|
| 456 | 456 | | (6) A statement that the consumer has a right to revoke the valid authorization at any time 5 |
|---|
| 457 | 457 | | and a description on how to submit a revocation of the valid authorization; 6 |
|---|
| 458 | 458 | | (7) A statement that the consumer health data sold pursuant to the valid authorization may 7 |
|---|
| 459 | 459 | | be subject to redisclosure by the purchaser and may no longer be protected by this section; 8 |
|---|
| 460 | 460 | | (8) An expiration date for the valid authorization that expires one year from when the 9 |
|---|
| 461 | 461 | | consumer signs the valid authorization; and 10 |
|---|
| 462 | 462 | | (9) The signature of the consumer and date. 11 |
|---|
| 463 | 463 | | (c) An authorization is not valid if the document has any of the following defects: 12 |
|---|
| 464 | 464 | | (i) The expiration date has passed; 13 |
|---|
| 465 | 465 | | (ii) The authorization does not contain all the information required under this section; 14 |
|---|
| 466 | 466 | | (iii) The authorization has been revoked by the consumer; 15 |
|---|
| 467 | 467 | | (iv) The authorization has been combined with other documents to create a compound 16 |
|---|
| 468 | 468 | | authorization; or 17 |
|---|
| 469 | 469 | | (v) The provision of goods or services is conditioned on the consumer signing the 18 |
|---|
| 470 | 470 | | authorization. 19 |
|---|
| 471 | 471 | | (d) A copy of the signed valid authorization shall be provided to the consumer. 20 |
|---|
| 472 | 472 | | (e) The seller and purchaser of consumer health data shall retain a copy of all valid 21 |
|---|
| 473 | 473 | | authorizations for sale of consumer health data for six (6) years from the date of its signature or the 22 |
|---|
| 474 | 474 | | date when it was last in effect, whichever is later. 23 |
|---|
| 475 | 475 | | 23-101.1-10. Geofence restrictions. 24 |
|---|
| 476 | 476 | | It is unlawful for any person to implement a geofence around an entity that provides in-25 |
|---|
| 477 | 477 | | person health care services where such geofence is used to: 26 |
|---|
| 478 | 478 | | (1) Identify or track consumers seeking health care services; or, 27 |
|---|
| 479 | 479 | | (2) Collect consumer health data from consumers. 28 |
|---|
| 480 | 480 | | 23-101.1-11. Application of consumer protection act. 29 |
|---|
| 481 | 481 | | The legislature finds that the practices covered by this chapter are matters vitally affecting 30 |
|---|
| 482 | 482 | | the public interest for the purpose of applying chapter 13.1 of title 6. A violation of this chapter is 31 |
|---|
| 483 | 483 | | not reasonable in relation to the development and preservation of business, and is an unfair or 32 |
|---|
| 484 | 484 | | deceptive act in trade or commerce and an unfair method of competition for the purpose of applying 33 |
|---|
| 485 | 485 | | chapter 13.1 of title 6. 34 |
|---|
| 486 | 486 | | |
|---|
| 487 | 487 | | |
|---|
| 488 | 488 | | LC002361 - Page 14 of 17 |
|---|
| 489 | 489 | | 23-101.1-12. Exemptions. 1 |
|---|
| 490 | 490 | | (a) This chapter does not apply to: 2 |
|---|
| 491 | 491 | | (1) Information that meets the definition of: 3 |
|---|
| 492 | 492 | | (i) Protected health information for purposes of the federal Health Insurance Portability 4 |
|---|
| 493 | 493 | | and Accountability Act of 1996, as amended, and related regulations; 5 |
|---|
| 494 | 494 | | (ii) Health care information collected, used, or disclosed in accordance with chapter 37.3 6 |
|---|
| 495 | 495 | | of title 5; 7 |
|---|
| 496 | 496 | | (iii) Patient identifying information collected, used, or disclosed in accordance with 42 8 |
|---|
| 497 | 497 | | C.F.R. Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2; 9 |
|---|
| 498 | 498 | | (iv) Identifiable private information for purposes of the federal policy for the protection of 10 |
|---|
| 499 | 499 | | human subjects, 45 C.F.R. Part 46; identifiable private information that is otherwise information 11 |
|---|
| 500 | 500 | | collected as part of human subjects research pursuant to the good clinical practice guidelines issued 12 |
|---|
| 501 | 501 | | by the international council for harmonization; the protection of human subjects under 21 C.F.R. 13 |
|---|
| 502 | 502 | | Parts 50 and 56; or personal data used or shared in research conducted in accordance with one or 14 |
|---|
| 503 | 503 | | more of the requirements set forth in this subsection; 15 |
|---|
| 504 | 504 | | (v) Information and documents created specifically for, and collected and maintained by: 16 |
|---|
| 505 | 505 | | (A) A quality improvement program for purposes of chapter 17.17 of title 23; 17 |
|---|
| 506 | 506 | | (B) A peer review committee for purposes of § 23-17-25; 18 |
|---|
| 507 | 507 | | (C) A quality assurance committee for purposes of chapter 17.17 of title 23; or 19 |
|---|
| 508 | 508 | | (D) A hospital, for reporting of health care-associated adverse events for purposes of § 23-20 |
|---|
| 509 | 509 | | 17-40. 21 |
|---|
| 510 | 510 | | (vi) Information and documents created for purposes of the federal Health Care Quality 22 |
|---|
| 511 | 511 | | Improvement Act of 1986, and related regulations; 23 |
|---|
| 512 | 512 | | (vii) Patient safety work product for purposes of 42 C.F.R. Part 3, established pursuant to 24 |
|---|
| 513 | 513 | | 42 U.S.C. Sec. 299b-21 through 299b-26; 25 |
|---|
| 514 | 514 | | (viii) Information that is: 26 |
|---|
| 515 | 515 | | (A) Deidentified in accordance with the requirements for deidentification set forth in 45 27 |
|---|
| 516 | 516 | | C.F.R. Part 164; and 28 |
|---|
| 517 | 517 | | (B) Derived from any of the health care-related information listed in subsection (a)(1)(viii) 29 |
|---|
| 518 | 518 | | of this section; 30 |
|---|
| 519 | 519 | | (2) Information originating from, and intermingled to be indistinguishable with, 31 |
|---|
| 520 | 520 | | information under subsection (a)(1) of this section that is maintained by: 32 |
|---|
| 521 | 521 | | (i) A covered entity or business associate as defined by the federal Health Insurance 33 |
|---|
| 522 | 522 | | Portability and Accountability Act of 1996, as amended, and related regulations; 34 |
|---|
| 523 | 523 | | |
|---|
| 524 | 524 | | |
|---|
| 525 | 525 | | LC002361 - Page 15 of 17 |
|---|
| 526 | 526 | | (ii) A health care facility or health care provider; or 1 |
|---|
| 527 | 527 | | (iii) A program or a qualified service organization as defined by 42 C.F.R. Part 2, 2 |
|---|
| 528 | 528 | | established pursuant to 42 U.S.C. Sec. 290dd-2; 3 |
|---|
| 529 | 529 | | (3) Information used only for public health activities and purposes as described in 45 C.F.R. 4 |
|---|
| 530 | 530 | | Sec. 164.512 or that is part of a limited data set, as defined, and is used, disclosed, and maintained 5 |
|---|
| 531 | 531 | | in the manner required, by 45 C.F.R. Sec. 164.514 or corresponding state law. 6 |
|---|
| 532 | 532 | | (b) Personal information that is governed by and collected, used, or disclosed pursuant to 7 |
|---|
| 533 | 533 | | the following regulations, parts, titles, or acts, is exempt from this chapter: 8 |
|---|
| 534 | 534 | | (i) The Gramm-Leach-Bliley act (15 U.S.C. 6801 et seq.) and implementing regulations; 9 |
|---|
| 535 | 535 | | (ii) Part C of Title XI of the Social Security Act (42 U.S.C. 1320d et seq.); 10 |
|---|
| 536 | 536 | | (iii) The Fair Credit Reporting Act (15 U.S.C. 1681 et seq.); 11 |
|---|
| 537 | 537 | | (iv) The Family Educational Rights and Privacy Act (20 U.S.C. 1232g; Part 99 of Title 34, 12 |
|---|
| 538 | 538 | | C.F.R.); 13 |
|---|
| 539 | 539 | | (v) The Rhode Island health benefit exchange and applicable statutes and regulations, 14 |
|---|
| 540 | 540 | | including 45 C.F.R. Sec. 155.260 and §§ 42-157-1 et seq.; or 15 |
|---|
| 541 | 541 | | (vi) Privacy rules adopted by the office of the insurance commissioner. 16 |
|---|
| 542 | 542 | | (c) The obligations imposed on regulated entities, small businesses, and processors under 17 |
|---|
| 543 | 543 | | this chapter does not restrict a regulated entity's, small businesses, or processor's ability for 18 |
|---|
| 544 | 544 | | collection, use, or disclosure of consumer health data to prevent, detect, protect against, or respond 19 |
|---|
| 545 | 545 | | to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any 20 |
|---|
| 546 | 546 | | activity that is illegal under Rhode Island law or federal law; preserve the integrity or security of 21 |
|---|
| 547 | 547 | | systems; or investigate, report, or prosecute those responsible for any such action that is illegal 22 |
|---|
| 548 | 548 | | under Rhode Island law or federal law. 23 |
|---|
| 549 | 549 | | (4) If a regulated entity, small business, or processor processes consumer health data 24 |
|---|
| 550 | 550 | | pursuant to subsection (a)(3) of this section, such entity bears the burden of demonstrating that such 25 |
|---|
| 551 | 551 | | processing qualifies for the exemption and complies with the requirements of this section. 26 |
|---|
| 552 | 552 | | 23-101.1-13. Penalties and remedies. 27 |
|---|
| 553 | 553 | | (a) A person who alleges a violation of this chapter may bring a civil action for appropriate 28 |
|---|
| 554 | 554 | | injunctive relief and compensatory and punitive damages in the superior court for the county where 29 |
|---|
| 555 | 555 | | the alleged violation occurred, the county where the complainant resides, or the county where the 30 |
|---|
| 556 | 556 | | person against whom the civil complaint is filed resides or has their principal place of business. A 31 |
|---|
| 557 | 557 | | prevailing plaintiff shall be entitled to an award of reasonable attorneys’ fees and costs. 32 |
|---|
| 558 | 558 | | (b) A violation of this chapter shall also constitute a deceptive trade practice in violation 33 |
|---|
| 559 | 559 | | of chapter 13.1 of title 6, and the attorney general may bring an enforcement action over violations 34 |
|---|
| 560 | 560 | | |
|---|
| 561 | 561 | | |
|---|
| 562 | 562 | | LC002361 - Page 16 of 17 |
|---|
| 563 | 563 | | of this chapter. 1 |
|---|
| 564 | 564 | | SECTION 2. This act shall take effect upon passage. 2 |
|---|
| 565 | 565 | | ======== |
|---|
| 566 | 566 | | LC002361 |
|---|
| 567 | 567 | | ======== |
|---|
| 568 | 568 | | |
|---|
| 569 | 569 | | |
|---|
| 570 | 570 | | LC002361 - Page 17 of 17 |
|---|
| 571 | 571 | | EXPLANATION |
|---|
| 572 | 572 | | BY THE LEGISLATIVE COUNCIL |
|---|
| 573 | 573 | | OF |
|---|
| 574 | 574 | | A N A C T |
|---|
| 575 | 575 | | RELATING TO HEALTH AND SAFETY -- REPRODUCTIVE FREEDOM AND GENDER |
|---|
| 576 | 576 | | AFFIRMING CARE HEALTH DATA PRIVACY ACT |
|---|
| 577 | 577 | | *** |
|---|
| 578 | 578 | | This act would create the reproductive freedom and gender affirming care health data 1 |
|---|
| 579 | 579 | | privacy act. 2 |
|---|
| 580 | 580 | | This act would take effect upon passage. 3 |
|---|
| 581 | 581 | | ======== |
|---|
| 582 | 582 | | LC002361 |
|---|
| 583 | 583 | | ======== |
|---|
| 584 | 584 | | |
|---|