Text of NV SB 370 (2023)

S.B. 370 - *SB370* SENATE BILL NO. 370–SENATORS CANNIZZARO, NGUYEN, DONATE; DALY, D. HARRIS, LANGE, NEAL, PAZINA AND SCHEIBLE MARCH 23, 2023 ____________ Referred to Committee on Commerce and Labor SUMMARY—Revises provisions relating to consumer health data. (BDR 52-42) FISCAL NOTE: Effect on Local Government: No. Effect on the State: Yes. ~ EXPLANATION – Matter in bolded italics is new; matter between brackets [omitted material] is material to be omitted. AN ACT relating to data privacy; requiring certain entities to develop, maintain and make available on the Internet a policy concerning the privacy of consumer health data; prohibiting such an entity from collecting or sharing consumer health data without the affirmative consent of a consumer in certain circumstances; requiring such an entity to perform certain actions upon the request of a consumer; requiring such an entity to establish a process to appeal the denial of such a request; requiring such an entity to take certain actions to protect the security of consumer health data; limiting the circumstances under which a processor is authorized to process consumer health data; requiring a processor to assist certain entities in complying with certain requirements; prohibiting a person from selling or offering to sell consumer health data under certain circumstances; prohibiting the implementation of a geofence under certain circumstances; prohibiting discrimination against a consumer for certain reasons; authorizing certain civil actions; providing penalties; and providing other matters properly relating thereto. – 2 – - *SB370* Legislative Counsel’s Digest: Existing federal law and regulations contain various protections for health 1 information maintained or used: (1) by a person or entity that provides health care, 2 an insurer or a business associate of a person or entity that provides health care or 3 an insurer; or (2) for scientific research. (42 U.S.C. §§ 11101 et seq.; Pub. L. No. 4 104-191, 100 Stat. 2548; 21 C.F.R. Parts 46, 50 and 56, 42 C.F.R. Parts 2 and 3, 45 5 C.F.R. Parts 160 and 164) This bill prescribes various protections for consumer 6 health data that is maintained and used by other persons and nongovernmental 7 entities and for other purposes. Section 7 of this bill defines the term “consumer” to 8 mean a natural person who resides in this State or whose consumer health data is 9 collected in this State, except for a natural person acting in an employment context. 10 Section 8 of this bill defines the term “consumer health data” to mean personally 11 identifiable information that is linked or reasonably capable of being linked to a 12 consumer and is related to the health of the consumer. Section 15 of this bill 13 defines the term “regulated entity” to refer to a person who: (1) conducts business 14 in this State or produces or provides products or services that are targeted to 15 consumers in this State; and (2) determines the purpose and means of processing, 16 sharing or selling consumer health data. Sections 3-6, 9-14 and 16-19 of this bill 17 define certain other terms. Section 20 of this bill provides that the provisions of this 18 bill do not apply to certain data that is collected or disclosed under certain 19 provisions of federal law or regulations or state law. 20 Section 21 of this bill requires a regulated entity to develop, maintain and make 21 available on the Internet a policy concerning the privacy of consumer health data. 22 Section 21 also prohibits a regulated entity from: (1) taking certain actions with 23 regard to consumer health data that are inconsistent with the policy without the 24 affirmative consent of the consumer; or (2) entering into a contract for the 25 processing of consumer health data that is inconsistent with the policy. Section 22 26 of this bill generally prohibits a regulated entity from collecting or sharing 27 consumer health data without the affirmative consent of the consumer to whom the 28 data relates, except to the extent necessary to provide a product or service that the 29 consumer has requested from the regulated entity. Sections 22 and 23 of this bill 30 prescribe certain requirements governing such consent. 31 Section 24 of this bill requires a regulated entity, upon the request of a 32 consumer, to: (1) confirm whether the regulated entity is collecting, sharing or 33 selling consumer health data concerning the consumer; (2) provide the consumer 34 with a list of all third parties and affiliates with whom the regulated entity has 35 shared or to whom the regulated entity has sold consumer health data relating to the 36 consumer; (3) cease collecting or sharing consumer health data relating to the 37 consumer; or (4) delete consumer health data concerning the consumer. Section 24 38 also requires a regulated entity to establish a secure and reliable means of making 39 such a request. Section 25 of this bill prescribes requirements governing the 40 response to such a request, including a requirement that a regulated entity provide 41 information in response to such a request free of charge in most circumstances. 42 However, if a consumer submits more than two requests in a year and those 43 requests are manifestly unfounded, excessive or repetitive, section 25 authorizes 44 the regulated entity to charge a reasonable fee to provide such information. Section 45 26 of this bill prescribes requirements governing the time within which a regulated 46 entity or an affiliate, processor or other third party with which a regulated entity has 47 shared data must delete consumer health data in response to a request for such 48 deletion. Section 27 of this bill requires a regulated entity to establish a process to 49 appeal the refusal of the regulated entity to act on a request made pursuant to 50 section 24. Section 32 of this bill: (1) requires a regulated entity, contractor of a 51 regulated entity, processor or other third party to disclose consumer health data 52 where required by law, court order, subpoena or search warrant; (2) authorizes 53 certain other disclosures of consumer health data; and (3) provides that a regulated 54 – 3 – - *SB370* entity, contractor, processor or third party who discloses consumer health data 55 under such circumstances is not required to comply with sections 22-27. 56 Section 28 of this bill requires a regulated entity to limit access to and 57 establish, implement and maintain policies and procedures to protect the security of 58 consumer health data. Section 29 of this bill requires a processor who processes 59 consumer health data on behalf of a regulated entity to only process such data in 60 accordance with a written contract between the processor and the regulated entity. 61 Section 29 also requires such a processor to assist a regulated entity in complying 62 with the provisions of this bill. 63 Section 30 of this bill prohibits a person from selling or offering to sell 64 consumer health data without the written authorization of the consumer to whom 65 the data pertains or beyond the scope of such authorization, with certain exceptions. 66 Section 30 also prohibits a person from conditioning the provision of goods or 67 services on a consumer providing such authorization. Section 30 requires a person 68 who sells consumer health data to: (1) establish a means by which a consumer may 69 revoke such written authorization; and (2) provide a copy of such written 70 authorization to the consumer. Section 30 also requires both a seller and a 71 purchaser of consumer health data to maintain such written authorization for at 72 least 6 years after the expiration of the written authorization. 73 Section 31 of this bill prohibits a person from implementing a geofence around 74 any person or entity that provides in-person health care services or products for 75 certain purposes. Section 33 of this bill prohibits a regulated entity from 76 discriminating against a consumer for taking any action authorized by this bill or to 77 enforce the provisions of this bill. 78 Existing law provides that a variety of actions constitute deceptive trade 79 practices. (NRS 118A.275, 205.377, 228.620, 370.695, 597.997, 603.170, 80 604B.910, 676A.770; chapter 598 of NRS) Existing law authorizes a court to 81 impose a civil penalty of not more than $12,500 for each violation upon a person 82 whom the court finds has engaged in a deceptive trade practice directed toward an 83 elderly person or a person with a disability. (NRS 598.0973) Additionally, existing 84 law authorizes a court to make such additional orders or judgments as may be 85 necessary to restore to any person in interest any money or property which may 86 have been acquired by means of any deceptive trade practice. (NRS 598.0993) In 87 addition to these enforcement mechanisms, existing law provides that when the 88 Commissioner of Consumer Affairs or the Director of the Department of Business 89 and Industry has cause to believe that a person has engaged or is engaging in any 90 deceptive trade practice, the Commissioner or Director may request that the 91 Attorney General represent him or her in instituting an appropriate legal 92 proceeding, including an application for an injunction or temporary restraining 93 order. (NRS 598.0979) Existing law provides that if a person violates a court order 94 or injunction resulting from a complaint brought by the Commissioner, the 95 Director, the district attorney of any county of this State or the Attorney General, 96 the person is required to pay a civil penalty of not more than $10,000 for each 97 violation. Furthermore, if a court finds that a person has willfully engaged in a 98 deceptive trade practice, the person who committed the violation: (1) may be 99 required to pay an additional civil penalty not more than $5,000 for each violation; 100 and (2) is guilty of a felony or misdemeanor, depending on the value of the 101 property or services lost as a result of the deceptive trade practice. (NRS 598.0999) 102 Existing law: (1) provides that certain deceptive trade practices constitute consumer 103 fraud; and (2) authorizes a person injured by consumer fraud to bring a civil action. 104 (NRS 41.600) With certain exceptions, section 34 of this bill: (1) provides that a 105 person who violates any provision of this bill is guilty of a deceptive trade practice; 106 and (2) authorizes a person injured by such a violation to bring a civil action. 107 Section 35 of this bill exempts consumer health data from provisions of existing 108 – 4 – - *SB370* law governing information collected on the Internet from consumers because those 109 provisions are less stringent than the provisions of sections 2-34 of this bill. 110 THE PEOPLE OF THE STATE OF NEVADA, REPRESENTED IN SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS: Section 1. Chapter 603A of NRS is hereby amended by 1 adding thereto the provisions set forth as sections 2 to 34, inclusive, 2 of this act. 3 Sec. 2. As used in sections 2 to 34, inclusive, of this act, 4 unless the context otherwise requires, the words and terms defined 5 in sections 3 to 19, inclusive, of this act have the meanings 6 ascribed to them in those sections. 7 Sec. 3. “Affiliate” means an entity that shares common 8 branding with another entity and controls, is controlled by or is 9 under common control with the other entity. For the purposes of 10 this section, an entity shall be deemed to control another entity if 11 the entity: 12 1. Owns or has the power to vote at least half of the 13 outstanding shares of any class of voting security in the other 14 entity; 15 2. Controls in any manner the election of a majority of the 16 directors or persons exercising similar functions to directors of the 17 other entity; or 18 3. Has the power to exercise controlling influence over the 19 management of the other entity. 20 Sec. 4. “Authenticate” means to ascertain the identity of the 21 originator of an electronic or physical document and establish a 22 link between the document and the originator. 23 Sec. 5. “Biometric data” means data which is generated from 24 the measurement or technical processing of the physiological, 25 biological or behavioral characteristics of a person and, alone or 26 in combination with other data, is capable of being used to identify 27 the person. The term includes, without limitation: 28 1. Imagery of the fingerprint, palm print, hand print, scar, 29 bodily mark, tattoo, voiceprint, face, retina, iris or vein pattern of a 30 person; and 31 2. Keystroke patterns or rhythms and gait patterns or rhythms 32 that contain identifying information. 33 Sec. 6. “Collect” means to buy, rent, access, retain, receive, 34 acquire, infer, derive or otherwise process consumer health data 35 in any manner. 36 Sec. 7. “Consumer” means a natural person who resides in 37 this State or whose consumer health data is collected in this State. 38 – 5 – - *SB370* The term does not include a natural person acting in an 1 employment context. 2 Sec. 8. “Consumer health data” means personally 3 identifiable information that is linked or reasonably capable of 4 being linked to a consumer and is related to the past, present or 5 future health of the consumer. The term includes, without 6 limitation: 7 1. Information relating to: 8 (a) Any health condition or status, disease or diagnosis; 9 (b) Social, psychological, behavioral or medical interventions; 10 (c) Surgeries or other health-related procedures; 11 (d) The use or acquisition of medication; 12 (e) Bodily functions, vital signs or symptoms; 13 (f) Reproductive or sexual health care; and 14 (g) Gender-affirming care; 15 2. Biometric data or genetic data related to information 16 described in subsection 1; 17 3. Information related to the precise location of a consumer 18 that is derived from technology, including, without limitation, a 19 global positioning system, and is reasonably capable of being used 20 to indicate an attempt by a consumer to receive health care 21 services or products; and 22 4. Any information described in subsection 1, 2 or 3 that is 23 derived or extrapolated from information that is not consumer 24 health data, including, without limitation, proxy, derivative, 25 inferred or emergent data derived through an algorithm, machine 26 learning or any other means. 27 Sec. 9. “Gender-affirming care” means health services or 28 products that support and affirm the gender identity of a person, 29 including, without limitation: 30 1. Treatments for gender dysphoria; 31 2. Gender-affirming hormone therapy; and 32 3. Gender-affirming surgery. 33 Sec. 10. “Genetic data” means any data that concerns the 34 genetic characteristics of a person. The term includes, without 35 limitation: 36 1. Data directly resulting from the sequencing of all or a 37 portion of the deoxyribonucleic acid of a person; 38 2. Genotypic and phenotypic information that results from 39 analyzing the information described in subsection 1; and 40 3. Data concerning the health of a person that is analyzed in 41 connection with the information described in subsection 1. 42 Sec. 11. “Health care services or products” means any 43 service or product provided to a person to assess, measure, 44 – 6 – - *SB370* improve or learn about the health of a person. The term includes, 1 without limitation: 2 1. Services relating to any health condition or status, disease 3 or diagnosis; 4 2. Social, psychological, behavioral or medical interventions; 5 3. Surgeries or other health-related procedures; 6 4. Medication or services related to the use or acquisition of 7 medication; or 8 5. Monitoring or measurement related to bodily functions, 9 vital signs or symptoms. 10 Sec. 12. “Personally identifiable information” means 11 information that, alone or in combination with other information, 12 may be used to identify a person or an electronic device used by 13 the person. The term: 14 1. Includes, without limitation: 15 (a) Data associated with an Internet protocol address, device 16 identifier or other form of persistent unique identifier; and 17 (b) Any data about a person that is collected without the 18 consent of the person. 19 2. Does not include: 20 (a) Information that is made lawfully available through the 21 records of a federal, state or local governmental entity or widely 22 distributed media and which a regulated entity has a reasonable 23 basis to believe that a person has made available to the general 24 public; or 25 (b) Deidentified information. 26 Sec. 13. “Process” means any operation or set of operations 27 performed on consumer health data. 28 Sec. 14. “Processor” means a person who processes 29 consumer health data on behalf of a regulated entity. 30 Sec. 15. “Regulated entity” means any person who: 31 1. Conducts business in this State or produces or provides 32 products or services that are targeted to consumers in this State; 33 and 34 2. Alone or with other persons, determines the purpose and 35 means of processing, sharing or selling consumer health data. 36 Sec. 16. “Reproductive or sexual health care” means health 37 care services or products that support or relate to the reproductive 38 system or sexual well-being of a person. The term includes, 39 without limitation, abortion, the provision of medication to induce 40 an abortion and any medical or nonmedical services associated 41 with an abortion. 42 Sec. 17. “Sell” means to exchange consumer health 43 information for money or other valuable consideration. 44 – 7 – - *SB370* Sec. 18. “Share” means to release, disclose, disseminate, 1 divulge, make available, provide access to, license or otherwise 2 communicate consumer health data orally, in writing or by 3 electronic or other means. 4 Sec. 19. “Third party” means a person who is not a 5 consumer, regulated entity, processor or affiliate of a regulated 6 entity. 7 Sec. 20. The provisions of sections 2 to 34, inclusive, of this 8 act do not apply to: 9 1. Information that is collected, used or shared in accordance 10 with the Health Insurance Portability and Accountability Act of 11 1996, Public Law 104-191, and the regulations adopted pursuant 12 thereto. 13 2. Information originating from, and intermingled with to be 14 indistinguishable from, information described in subsection 1 that 15 is maintained by: 16 (a) A covered entity or business associate, as those terms are 17 defined in 45 C.F.R. § 160.103; or 18 (b) A program or qualified service organization, as those terms 19 are defined in 45 C.F.R. § 2.11. 20 3. Patient identifying information, as defined in 42 C.F.R. § 21 2.11, that is collected, used or disclosed in accordance with 42 22 C.F.R. Part 2. 23 4. Patient safety work product, as defined in 42 C.F.R. § 3.20, 24 that is collected, used or disclosed in accordance with 42 C.F.R. 25 Part 3. 26 5. Identifiable private information, as defined in 45 C.F.R. § 27 46.102, that is collected, used or disclosed in accordance with 45 28 C.F.R. Part 46. 29 6. Information used or shared as part of research conducted 30 pursuant to 45 C.F.R. Part 46 or 21 C.F.R. Parts 50 and 56. 31 7. Information used only for public health activities and 32 purposes, as described in 45 C.F.R. § 164.512(b), regardless of 33 whether such information is subject to the Health Insurance 34 Portability and Accountability Act of 1996, Public Law 104-191, 35 and the regulations adopted pursuant thereto. 36 8. Personally identifiable information that is governed by and 37 collected, used or disclosed pursuant to: 38 (a) The Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801 et seq., 39 and the regulations adopted pursuant thereto; 40 (b) Part C of Title XI of the Social Security Act, 42 U.S.C. §§ 41 1320d et seq.; 42 (c) The Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq.; 43 or 44 – 8 – - *SB370* (d) The Family Educational Rights and Privacy Act of 1974, 1 20 U.S.C. § 1232g, and the regulations adopted pursuant thereto. 2 9. Information and documents created for the purposes of 3 compliance with the federal Health Care Quality Improvement Act 4 of 1986, 42 U.S.C. §§ 11101 et seq., and any regulations adopted 5 pursuant thereto. 6 10. The collection or sharing of consumer health data where 7 expressly authorized by any provision of state law. 8 11. Any governmental or tribal entity or any person 9 processing consumer health data on behalf of a governmental or 10 tribal entity. 11 Sec. 21. 1. A regulated entity shall develop and maintain a 12 policy concerning the privacy of consumer health data that clearly 13 and conspicuously establishes: 14 (a) The categories of consumer health data being collected by 15 the regulated entity and the manner in which the consumer health 16 data will be used; 17 (b) The categories of sources from which consumer health 18 data is collected; 19 (c) The categories of consumer health data that are shared by 20 the regulated entity; 21 (d) A list of third parties and affiliates with whom the 22 regulated entity shares consumer health data; 23 (e) The purposes of collecting, using and sharing consumer 24 health data; 25 (f) The manner in which consumer health data will be 26 processed; 27 (g) The procedure for submitting a request pursuant to section 28 24 of this act; 29 (h) The process, if any such process exists, for a consumer to 30 review and request changes to any of his or her consumer health 31 data that is collected by the regulated entity; 32 (i) The process by which the regulated entity notifies 33 consumers whose consumer health data is collected by the 34 regulated entity of material changes to the privacy policy; 35 (j) Whether a third party may collect consumer health data 36 over time and across different Internet websites or online services 37 when the consumer uses any Internet website or online service of 38 the regulated entity; and 39 (k) The effective date of the privacy policy. 40 2. A regulated entity shall post conspicuously on the main 41 Internet website maintained by the regulated entity a hyperlink to 42 the policy developed pursuant to subsection 1. 43 3. A regulated entity shall not: 44 – 9 – - *SB370* (a) Collect, use or share categories of consumer health data, 1 other than those included in the privacy policy pursuant to 2 paragraph (c) of subsection 1, without disclosing those additional 3 categories to each consumer whose data will be collected, used or 4 shared and obtaining the affirmative consent of the consumer; 5 (b) Share consumer health data with a third party or affiliate, 6 other than those included in the privacy policy pursuant to 7 paragraph (d) of subsection 1, without disclosing those additional 8 third parties or affiliates to each consumer whose data will be 9 shared and obtaining the affirmative consent of the consumer; 10 (c) Collect, use or share consumer health data for purposes 11 other than those included in the privacy policy pursuant to 12 paragraph (e) of subsection 1 without disclosing those additional 13 purposes to each consumer whose data will be collected, used or 14 shared and obtaining the affirmative consent of the consumer; or 15 (d) Enter into a contract pursuant to section 29 of this act with 16 a processer to process consumer health data that is inconsistent 17 with the privacy policy. 18 Sec. 22. 1. A regulated entity shall not collect consumer 19 health data except: 20 (a) With the affirmative consent of the consumer; or 21 (b) To the extent necessary to provide a product or service that 22 the consumer to whom the consumer health data relates has 23 requested from the regulated entity. 24 2. A regulated entity shall not share consumer health data 25 except: 26 (a) With the affirmative consent of the consumer to whom the 27 consumer health data relates, which must be separate and distinct 28 from the consent provided pursuant to subsection 1 for the 29 collection of the data; 30 (b) To the extent necessary to provide a product or service that 31 the consumer to whom the consumer health data relates has 32 requested from the regulated entity; or 33 (c) Where required or authorized by section 32 of this act. 34 3. Any consent required by this section must be obtained 35 before the collection or sharing, as applicable, of consumer health 36 data. The request for such consent must clearly and conspicuously 37 disclose: 38 (a) The categories of consumer health data to be collected or 39 shared, as applicable; 40 (b) The purpose for collecting or sharing, as applicable, the 41 consumer health data including, without limitation, the manner in 42 which the consumer health data will be used; 43 – 10 – - *SB370* (c) If the consumer health data will be shared, the categories 1 of persons and entities with whom the consumer health data will 2 be shared; and 3 (d) The manner in which the consumer may withdraw consent 4 for the collection or sharing, as applicable, of consumer health 5 data relating to the consumer and request that the regulated entity 6 cease such collection or sharing pursuant to section 24 of this act. 7 Sec. 23. Any consent provided pursuant to section 21 or 22 of 8 this act must be an affirmative, voluntary act. Such consent may 9 be provided electronically, but may not be provided through: 10 1. The acceptance of a general agreement concerning terms 11 of use or a similar agreement that contains descriptions of the 12 manner in which personal data will be used or processed and 13 other unrelated information; 14 2. A consumer hovering over, muting, pausing or closing a 15 piece of online content; or 16 3. The use of a user interface designed or manipulated with 17 the effect of subverting or impairing the autonomy, decision 18 making or choice of the user. 19 Sec. 24. 1. Except as otherwise provided in section 25 of 20 this act, upon the request of a consumer, a regulated entity shall: 21 (a) Confirm whether the regulated entity is collecting, sharing 22 or selling consumer health data relating to the consumer. 23 (b) Provide the consumer with a list of all third parties and 24 affiliates with whom the regulated entity has shared consumer 25 health data relating to the consumer or to whom the regulated 26 entity has sold such consumer health data. The list must include, 27 without limitation, a valid electronic mail address for each such 28 third party or affiliate or another valid mechanism by which the 29 consumer may contact each such third party or affiliate using the 30 Internet. 31 (c) Cease collecting, sharing or selling consumer health data 32 relating to the consumer. 33 (d) Delete consumer health data concerning the consumer. 34 2. A regulated entity shall establish a secure and reliable 35 means of making a request pursuant to this section. The means of 36 making such a request must not require a consumer to create a 37 new account with the regulated entity, but may require the 38 consumer to use an existing account. When establishing the 39 means for making such a request, the regulated entity must 40 consider: 41 (a) The need for the safe and reliable communication of such 42 requests; and 43 (b) The ability of the regulated entity to authenticate the 44 identity of the consumer making the request. 45 – 11 – - *SB370* Sec. 25. 1. Except as otherwise provided in this section, a 1 regulated entity shall respond to a request made pursuant to 2 section 24 of this act without undue delay and not later than 45 3 days after authenticating the request. If reasonably necessary 4 based on the complexity and number of requests from the same 5 consumer, the regulated entity may extend the period prescribed 6 by this section not more than an additional 45 days. A regulated 7 entity that grants itself such an extension must, not later than 45 8 days after authenticating the request, provide the consumer with 9 notice of the extension and the reasons therefor. 10 2. If a regulated entity is not able to authenticate a request 11 made pursuant to section 24 of this act after making commercially 12 reasonable efforts, the regulated entity: 13 (a) Is not required to comply with the request; and 14 (b) May request that the consumer provide such additional 15 information as is reasonably necessary to authenticate the request. 16 3. A regulated entity: 17 (a) Shall provide information free of charge to a consumer in 18 response to: 19 (1) Requests made pursuant to section 24 of this act at least 20 twice each year; and 21 (2) Additional requests that are not manifestly unfounded, 22 excessive or repetitive. 23 (b) Except as otherwise provided in paragraph (a), may charge 24 a reasonable fee to provide information to a consumer in response 25 to requests made pursuant to section 24 of this act that are 26 manifestly unfounded, excessive or repetitive. 27 4. In any civil proceeding challenging the validity of a fee 28 charged pursuant to paragraph (b) of subsection 3, the regulated 29 entity has the burden of demonstrating by a preponderance of the 30 evidence that the request to which the fee pertained was manifestly 31 unfounded, excessive or repetitive. 32 5. In any criminal proceeding to enforce the provisions of 33 this section, it is an affirmative defense that the regulated entity 34 charged a fee pursuant to paragraph (b) of subsection 3 in 35 response to a request that was manifestly unfounded, excessive or 36 repetitive. 37 Sec. 26. 1. Not later than 30 days after authenticating a 38 request made pursuant to paragraph (d) of subsection 1 of section 39 24 of this act for the deletion of consumer health data, a regulated 40 entity shall, except as otherwise provided in subsection 3: 41 (a) Delete all consumer health data described in the request 42 from the records and network of the regulated entity; and 43 – 12 – - *SB370* (b) Notify each affiliate, processor, contractor or other third 1 party with which the regulated entity has shared consumer health 2 data of the deletion request. 3 2. Not later than 30 days after receiving notification of a 4 deletion request pursuant to paragraph (b) of subsection 1, an 5 affiliate, processor, contractor or other third party shall, except as 6 otherwise provided in subsection 3, delete the consumer health 7 data described in the request from the records and network of the 8 affiliate, processor, contractor or other third party. 9 3. If data described in a deletion request made pursuant to 10 paragraph (d) of subsection 1 of section 24 of this act is stored or 11 archived on backup systems, a regulated entity or an affiliate, 12 processor, contractor or other third party may delay the deletion of 13 the data for not more than 6 months after the request is 14 authenticated, as necessary to restore the archived or backup 15 system. 16 Sec. 27. 1. A regulated entity shall establish a process by 17 which a consumer may appeal the refusal of the regulated entity to 18 act on a request made pursuant section 24 of this act. The process 19 must be: 20 (a) Conspicuously available on the Internet website of the 21 regulated entity; and 22 (b) Similar to the process for making a request pursuant to 23 section 24 of this act. 24 2. Not later than 45 days after receiving an appeal pursuant 25 to subsection 1, a regulated entity shall inform the consumer in 26 writing of: 27 (a) Any action taken in response to the appeal or any decision 28 not to take such action; 29 (b) The reasons for any such action or decision; and 30 (c) If the regulated entity decided not to take the action 31 requested in the appeal, the contact information for the Office of 32 the Attorney General. 33 Sec. 28. 1. A regulated entity shall only authorize the 34 employees, processors and contractors of the regulated entity to 35 access consumer health data where necessary to: 36 (a) Further the purpose for which the consumer consented to 37 the collection or sharing of the consumer data pursuant to section 38 22 of this act; or 39 (b) Provide a product or service that the consumer to whom 40 the consumer health data relates has requested from the regulated 41 entity. 42 2. A regulated entity shall establish, implement and maintain 43 policies and practices for the administrative, technical and 44 physical security of consumer health data. The policies must: 45 – 13 – - *SB370* (a) Satisfy the standard of care in the industry in which the 1 regulated entity operates to protect the confidentiality, integrity 2 and accessibility of consumer health data; 3 (b) Comply with the provisions of NRS 603A.010 to 603A.290, 4 inclusive, where applicable; and 5 (c) Be reasonable, taking into account the volume and nature 6 of the consumer health data at issue. 7 Sec. 29. 1. A processor shall only process consumer health 8 data pursuant to a contract between the processor and a regulated 9 entity. Such a contract must set forth the applicable processing 10 instructions and the specific actions that the processor is 11 authorized to take with regard to the consumer health data it 12 possesses on behalf of the regulated entity. 13 2. To the extent practicable, a processor shall assist a 14 regulated entity with which the processor has entered into a 15 contract pursuant to subsection 1 in complying with the provisions 16 of sections 2 to 34, inclusive, of this act. 17 3. If a processor processes consumer health data outside the 18 scope of a contract described in subsection 1 or in a manner 19 inconsistent with any provision of such a contract, the processor: 20 (a) Is not guilty of an unfair trade practice or subject to a civil 21 action pursuant to section 34 of this act solely because the 22 processor violated the requirements of this section; and 23 (b) Shall be deemed a regulated entity for the purposes of 24 sections 2 to 34, inclusive, of this act. 25 Sec. 30. 1. A person shall not sell or offer to sell consumer 26 health data: 27 (a) Without the written authorization of the consumer to whom 28 the data pertains; or 29 (b) If the consumer provides such written authorization, in a 30 manner that is outside the scope of or inconsistent with the written 31 authorization. 32 2. A person shall not condition the provision of goods or 33 services on a consumer authorizing the sale of consumer health 34 data pursuant to subsection 1. 35 3. Written authorization pursuant to subsection 1 must be 36 provided in a form written in plain language which includes, 37 without limitation: 38 (a) The name and contact information of the person selling the 39 consumer health data; 40 (b) A description of the specific consumer health data that the 41 person intends to sell; 42 (c) The name and contact information of the person 43 purchasing the consumer health data; 44 – 14 – - *SB370* (d) A description of the purpose of the sale, including, without 1 limitation, the manner in which the consumer health data will be 2 gathered and the manner in which the person described in 3 paragraph (c) intends to use the consumer health data; 4 (e) A statement of the provisions of subsection 2; 5 (f) A statement that the consumer may revoke the written 6 authorization at any time and a description of the means 7 established pursuant to subsection 4 for revoking the 8 authorization; 9 (g) A statement that any consumer health data sold pursuant 10 to the written authorization may be disclosed to additional persons 11 and entities by the person described in paragraph (c) and, after 12 such disclosure, is no longer subject to the protections of this 13 section; 14 (h) The date on which the written authorization expires 15 pursuant to subsection 5; and 16 (i) The signature of the consumer to which the consumer 17 health data pertains. 18 4. A person who sells consumer health data shall establish a 19 means by which a consumer may revoke a written authorization 20 made pursuant to subsection 1. 21 5. Written authorization provided pursuant to subsection 1 22 expires 1 year after the date on which the authorization is given. 23 6. A written authorization provided pursuant to subsection 1 24 is not valid if the written authorization: 25 (a) Was a condition for the provision of goods or services to 26 the consumer in violation of subsection 2; 27 (b) Does not comply with the requirements of subsection 3; 28 (c) Has been revoked pursuant to subsection 4; or 29 (d) Has expired pursuant to subsection 5. 30 7. A person who sells consumer health data shall provide a 31 copy of the written authorization provided pursuant to subsection 32 1 to the consumer who signed the written authorization. 33 8. A seller and purchaser of consumer health data shall each 34 retain a copy of the written authorization provided pursuant to 35 subsection 1 for at least 6 years after the date on which the written 36 authorization expired pursuant to subsection 5. 37 9. The provisions of this section do not apply to the sale of 38 consumer health data to: 39 (a) A processor in a manner consistent with the purpose for 40 which the consumer health data was collected, as disclosed to the 41 consumer to whom the consumer health data pertains pursuant to 42 section 22 of this act; or 43 (b) A third party as an asset that is part of a merger, 44 acquisition, bankruptcy or other transaction through which the 45 – 15 – - *SB370* third party assumes control of all or part of the assets of the 1 regulated entity. A third party that obtains consumer health data 2 from a regulated entity pursuant to this paragraph assumes all 3 obligations of the regulated entity to comply with the provisions of 4 sections 2 to 34, inclusive, of this act. 5 Sec. 31. 1. A person shall not implement a geofence within 6 2,000 feet of any medical facility, facility for the dependent or any 7 other person or entity that provides in-person health care services 8 or products for the purpose of: 9 (a) Identifying or tracking consumers seeking in-person health 10 care services or products; 11 (b) Collecting consumer health data; or 12 (c) Sending notifications, messages or advertisements to 13 consumers related to their consumer health data or health care 14 services or products. 15 2. As used in this section: 16 (a) “Facility for the dependent” has the meaning ascribed to it 17 in NRS 449.0045. 18 (b) “Geofence” means technology that uses coordinates for 19 global positioning, connectivity to cellular towers, cellular data, 20 radio frequency identification, wireless Internet data or any other 21 form of detecting the physical location of a person to establish a 22 virtual boundary around a specific physical location. 23 (c) “Medical facility” has the meaning ascribed to it in 24 NRS 449.0151. 25 Sec. 32. 1. A regulated entity, contractor of a regulated 26 entity, processor or other third party that is in possession of 27 consumer health data: 28 (a) Shall disclose the consumer health data where required by 29 law, a court order, a subpoena, a search warrant or other lawful 30 process; and 31 (b) Is not required to comply with the provisions of sections 22 32 to 27, inclusive, of this act, when making such a disclosure. 33 2. A regulated entity may share consumer health data without 34 complying with the provisions of sections 22 to 27, inclusive, of 35 this act: 36 (a) Directly with a processor for the purpose of providing 37 goods or services in a manner consistent with the purpose for 38 which the consumer health data was collected, as disclosed to the 39 consumer to whom the consumer health data pertains pursuant to 40 section 22 of this act. 41 (b) With a third party with whom the consumer to whom the 42 consumer health data relates has a direct relationship if: 43 (1) The disclosure is for the purpose of providing a product 44 or service requested by the consumer; 45 – 16 – - *SB370* (2) The regulated entity maintains control and ownership 1 of the consumer health data; and 2 (3) The third party uses the consumer health data as 3 directed by the regulated entity and in a manner consistent with 4 the purpose for which the consumer health data was collected, as 5 disclosed to the consumer to whom the consumer health data 6 relates pursuant to section 22 of this act. 7 (c) With a third party as an asset that is part of a merger, 8 acquisition, bankruptcy or other transaction through which the 9 third party assumes control of all or part of the assets of the 10 regulated entity. A third party that obtains consumer health data 11 from a regulated entity pursuant to this paragraph assumes all 12 obligations of the regulated entity to comply with the provisions of 13 sections 2 to 34, inclusive, of this act. 14 3. A regulated entity or processor may collect, use or disclose 15 consumer health data without complying with the provisions of 16 sections 22 to 27, inclusive, of this act to: 17 (a) Prevent, detect, protect against, respond to, investigate, 18 report or aid in the prosecution of malicious, deceptive or illegal 19 activities, security incidents, identity theft, fraud or harassment; or 20 (b) Preserve the integrity or security of electronic systems. 21 4. In any civil proceeding where a regulated entity or 22 processor is alleged to have failed to comply with the provisions of 23 sections 22 to 27, inclusive, of this act, a regulated entity or 24 processor that collected, used or disclosed the consumer health 25 data for a purpose described in subsection 3 has the burden of 26 demonstrating by a preponderance of the evidence that the 27 collection, use or disclosure was for such a purpose. 28 5. In any criminal proceeding where a regulated entity or 29 processor is alleged to have failed to comply with the provisions of 30 sections 22 to 27, inclusive, of this act, it is an affirmative defense 31 that a regulated entity or processor collected, used or disclosed 32 consumer health data for a purpose described in subsection 3. 33 Sec. 33. A regulated entity shall not discriminate against a 34 consumer for taking: 35 1. Any action authorized by sections 2 to 34, inclusive, of this 36 act; or 37 2. Any action to enforce the provisions of sections 2 to 34, 38 inclusive, of this act. 39 Sec. 34. 1. Except as otherwise provided in section 29 of 40 this act: 41 (a) A violation of sections 2 to 34, inclusive, of this act 42 constitutes a deceptive trade practice for the purposes of NRS 43 598.0903 to 598.0999, inclusive. 44 – 17 – - *SB370* (b) An action may be brought by any person who is a victim of 1 a violation of sections 2 to 34, inclusive, of this act. If the claimant 2 is the prevailing party, the court shall award the claimant: 3 (1) Any damages that the claimant has sustained; 4 (2) Any equitable relief that the court deems appropriate; 5 and 6 (3) The claimant’s costs in the action and reasonable 7 attorney’s fees. 8 2. Any action brought pursuant to this section is not an 9 action upon any contract underlying the original transaction. 10 Sec. 35. NRS 603A.338 is hereby amended to read as follows: 11 603A.338 The provisions of NRS 603A.300 to 603A.360, 12 inclusive, do not apply to: 13 1. A consumer reporting agency, as defined in 15 U.S.C. § 14 1681a(f); 15 2. Any personally identifiable information regulated by the 16 Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq., and the 17 regulations adopted pursuant thereto, which is collected, maintained 18 or sold as provided in that Act; 19 3. A person who collects, maintains or makes sales of 20 personally identifiable information for the purposes of fraud 21 prevention; 22 4. Any personally identifiable information that is publicly 23 available; 24 5. Any personally identifiable information protected from 25 disclosure under the federal Driver’s Privacy Protection Act of 26 1994, 18 U.S.C. §§ 2721 et seq., which is collected, maintained or 27 sold as provided in that Act; [or] 28 6. Any consumer health data subject to the provisions of 29 sections 2 to 34, inclusive, of this act; or 30 7. A financial institution or an affiliate of a financial institution 31 that is subject to the provisions of the Gramm-Leach-Bliley Act, 15 32 U.S.C. §§ 6801 et seq., or any personally identifiable information 33 regulated by that Act which is collected, maintained or sold as 34 provided in that Act. 35 H

- 82nd Session (2023) Senate Bill No. 370–Senators Cannizzaro, Nguyen, Donate; Daly, D. Harris, Lange, Neal, Pazina and Scheible CHAPTER.......... AN ACT relating to data privacy; requiring certain entities to develop, maintain and make available on the Internet a policy concerning the privacy of consumer health data; prohibiting such an entity from collecting or sharing consumer health data without the affirmative, voluntary consent of a consumer in certain circumstances; requiring such an entity to perform certain actions upon the request of a consumer; requiring such an entity to establish a process to appeal the denial of such a request; requiring such an entity to take certain actions to protect the security of consumer health data; limiting the circumstances under which a processor is authorized to process consumer health data; requiring a processor to assist certain entities in complying with certain requirements; prohibiting a person from selling or offering to sell consumer health data under certain circumstances; prohibiting the implementation of a geofence under certain circumstances; prohibiting discrimination against a consumer for certain reasons; authorizing certain civil enforcement; providing penalties; and providing other matters properly relating thereto. Legislative Counsel’s Digest: Existing federal law and regulations contain various protections for health information maintained or used: (1) by a person or entity that provides health care, an insurer or a business associate of a person or entity that provides health care or an insurer; or (2) for scientific research. (42 U.S.C. §§ 11101 et seq.; Pub. L. No. 104-191, 100 Stat. 2548; 21 C.F.R. Parts 46, 50 and 56, 42 C.F.R. Parts 2 and 3, 45 C.F.R. Parts 160 and 164) Sections 2-34 of this bill prescribe various protections for consumer health data that is maintained and used by other persons and nongovernmental entities and for other purposes. Section 7 of this bill defines the term “consumer” to mean a natural person who has requested a product or service from a regulated entity and who resides in this State or whose consumer health data is collected in this State, except for a natural person acting in an employment context or as an agent of a governmental entity. Section 8 of this bill defines the term “consumer health data” to mean personally identifiable information that is linked or reasonably capable of being linked to a consumer and is used by a regulated entity to identify the health status of the consumer. Section 15 of this bill defines the term “regulated entity” to refer to a person who: (1) conducts business in this State or produces or provides products or services that are targeted to consumers in this State; and (2) determines the purpose and means of processing, sharing or selling consumer health data. Sections 3-6, 9-14 and 16-19 of this bill define certain other terms. Section 20 of this bill provides that the provisions of sections 2-34 do not apply to certain persons, entities and data, including: (1) certain persons and entities whose collection and disclosure of data is specifically – 2 – - 82nd Session (2023) regulated by federal law; and (2) certain data that is collected or disclosed under certain provisions of federal law or regulations or state law. Section 21 of this bill requires a regulated entity to develop, maintain and make available a policy concerning the privacy of consumer health data. Section 21 also prohibits a regulated entity from: (1) taking certain actions with regard to consumer health data that are inconsistent with the policy without the affirmative, voluntary consent of the consumer; or (2) entering into a contract for the processing of consumer health data that is inconsistent with the policy. Section 22 of this bill generally prohibits a regulated entity from collecting or sharing consumer health data without the affirmative, voluntary consent of the consumer to whom the data relates, except to the extent necessary to provide a product or service that the consumer has requested from the regulated entity. Section 22 of this bill prescribes certain requirements governing such consent. Section 24 of this bill requires a regulated entity, upon the request of a consumer, to: (1) confirm whether the regulated entity is collecting, sharing or selling consumer health data concerning the consumer; (2) provide the consumer with a list of all third parties with whom the regulated entity has shared or to whom the regulated entity has sold consumer health data relating to the consumer; (3) cease collecting or sharing consumer health data relating to the consumer; or (4) delete consumer health data concerning the consumer. Section 24 also requires a regulated entity to establish a secure and reliable means of making such a request. Section 25 of this bill prescribes requirements governing the response to such a request, including a requirement that a regulated entity provide information in response to such a request free of charge in most circumstances. However, if a consumer submits more than two requests in a year and those requests are manifestly unfounded, excessive or repetitive, section 25 authorizes the regulated entity to charge a reasonable fee to provide such information. Section 26 of this bill prescribes requirements governing the time within which a regulated entity or an affiliate, processor or other third party with which a regulated entity has shared data must delete consumer health data in response to a request for such deletion. Section 27 of this bill requires a regulated entity to establish a process to appeal the refusal of the regulated entity to act on a request made pursuant to section 24. Section 28 of this bill requires a regulated entity to limit access to and establish, implement and maintain policies and procedures to protect the security of consumer health data. Section 29 of this bill requires a processor who processes consumer health data on behalf of a regulated entity to only process such data in accordance with a written contract between the processor and the regulated entity. Section 29 also requires such a processor to assist the regulated entity in complying with the provisions of sections 2-34. Section 30 of this bill prohibits a person from selling or offering to sell consumer health data without the written authorization of the consumer to whom the data pertains or beyond the scope of such authorization, with certain exceptions. Section 30 also prohibits a person from conditioning the provision of goods or services on a consumer providing such authorization. Section 30 requires a person who sells consumer health data to: (1) establish a means by which a consumer may revoke such written authorization; and (2) provide a copy of such written authorization to the consumer and purchaser. Section 30 also requires both a seller and a purchaser of consumer health data to maintain such written authorization for at least 6 years after the expiration of the written authorization. Section 17 of this bill exempts certain activity from the definition of the term “sell,” thereby exempting such activity from the requirements of section 30. Section 31 of this bill prohibits a person from implementing a geofence within 1,750 feet of any person or entity that provides in-person health care services or – 3 – - 82nd Session (2023) products for certain purposes. Section 33 of this bill prohibits a regulated entity from discriminating against a consumer for taking any action authorized by sections 2-34 or to enforce those provisions. Existing law provides that a variety of actions constitute deceptive trade practices. (NRS 118A.275, 205.377, 228.620, 370.695, 597.997, 603.170, 604B.910, 676A.770; chapter 598 of NRS) Existing law authorizes a court to impose a civil penalty of not more than $12,500 for each violation upon a person whom the court finds has engaged in a deceptive trade practice directed toward an elderly person or a person with a disability. (NRS 598.0973) Additionally, existing law authorizes a court to make such additional orders or judgments as may be necessary to restore to any person in interest any money or property which may have been acquired by means of any deceptive trade practice. (NRS 598.0993) In addition to these enforcement mechanisms, existing law provides that when the Commissioner of Consumer Affairs or the Director of the Department of Business and Industry has cause to believe that a person has engaged or is engaging in any deceptive trade practice, the Commissioner or Director may request that the Attorney General represent him or her in instituting an appropriate legal proceeding, including an application for an injunction or temporary restraining order. (NRS 598.0979) Existing law provides that if a person violates a court order or injunction resulting from a complaint brought by the Commissioner, the Director, the district attorney of any county of this State or the Attorney General, the person is required to pay a civil penalty of not more than $10,000 for each violation. Furthermore, if a court finds that a person has willfully engaged in a deceptive trade practice, the person who committed the violation: (1) may be required to pay an additional civil penalty not more than $5,000 for each violation; and (2) is guilty of a felony or misdemeanor, depending on the value of the property or services lost as a result of the deceptive trade practice. (NRS 598.0999) With certain exceptions, section 34 of this bill provides that a person who violates any provision of sections 2-34 is guilty of a deceptive trade practice. Sections 1 and 34 of this bill provide that a person injured by such a violation does not have a private right of action. Section 34 additionally provides that the provisions of sections 2-34 must not be construed to affect any other provision of law. Section 35 of this bill exempts consumer health data from provisions of existing law governing information collected on the Internet from consumers because those provisions are less stringent than the provisions of sections 2-34. EXPLANATION – Matter in bolded italics is new; matter between brackets [omitted material] is material to be omitted. THE PEOPLE OF THE STATE OF NEVADA, REPRESENTED IN SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS: Section 1. NRS 598.0977 is hereby amended to read as follows: 598.0977 [If] Except as otherwise provided in section 34 of this act, an elderly person or a person with a disability suffers damage or injury as a result of a deceptive trade practice, he or she or his or her legal representative, if any, may commence a civil action against any person who engaged in the practice to recover the actual damages suffered by the elderly person or person with a – 4 – - 82nd Session (2023) disability, punitive damages, if appropriate, and reasonable attorney’s fees. The collection of any restitution awarded pursuant to this section has a priority over the collection of any civil penalty imposed pursuant to NRS 598.0973. Sec. 1.5. Chapter 603A of NRS is hereby amended by adding thereto the provisions set forth as sections 2 to 34.9, inclusive, of this act. Sec. 2. As used in sections 2 to 34, inclusive, of this act, unless the context otherwise requires, the words and terms defined in sections 3 to 19, inclusive, of this act have the meanings ascribed to them in those sections. Sec. 3. “Affiliate” means an entity that shares common branding with another entity and controls, is controlled by or is under common control with the other entity. For the purposes of this section, an entity shall be deemed to control another entity if the entity: 1. Owns or has the power to vote at least half of the outstanding shares of any class of voting security in the other entity; 2. Controls in any manner the election of a majority of the directors or persons exercising similar functions to directors of the other entity; or 3. Has the power to exercise controlling influence over the management of the other entity. Sec. 4. “Authenticate” means to ascertain the identity of the originator of an electronic or physical document and establish a link between the document and the originator. Sec. 5. “Biometric data” means data which is generated from the measurement or technical processing of the physiological, biological or behavioral characteristics of a person and, alone or in combination with other data, is capable of being used to identify the person. The term includes, without limitation: 1. Imagery of the fingerprint, palm print, hand print, scar, bodily mark, tattoo, voiceprint, face, retina, iris or vein pattern of a person; and 2. Keystroke patterns or rhythms and gait patterns or rhythms that contain identifying information. Sec. 6. “Collect” means to buy, rent, access, retain, receive, acquire, infer, derive or otherwise process consumer health data in any manner. Sec. 7. “Consumer” means a natural person who has requested a product or service from a regulated entity and who resides in this State or whose consumer health data is collected in – 5 – - 82nd Session (2023) this State. The term does not include a natural person acting in an employment context or as an agent of a governmental entity. Sec. 8. “Consumer health data” means personally identifiable information that is linked or reasonably capable of being linked to a consumer and that a regulated entity uses to identify the past, present or future health status of the consumer. The term: 1. Includes, without limitation: (a) Information relating to: (1) Any health condition or status, disease or diagnosis; (2) Social, psychological, behavioral or medical interventions; (3) Surgeries or other health-related procedures; (4) The use or acquisition of medication; (5) Bodily functions, vital signs or symptoms; (6) Reproductive or sexual health care; and (7) Gender-affirming care; (b) Biometric data or genetic data related to information described in paragraph (a); (c) Information related to the precise geolocation information of a consumer that a regulated entity uses to indicate an attempt by a consumer to receive health care services or products; and (d) Any information described in paragraph (a), (b) or (c) that is derived or extrapolated from information that is not consumer health data, including, without limitation, proxy, derivative, inferred or emergent data derived through an algorithm, machine learning or any other means. 2. Does not include information that is used to: (a) Provide access to or enable gameplay by a person on a video game platform; or (b) Identify the shopping habits or interests of a consumer, if that information is not used to identify the specific past, present or future health status of the consumer. Sec. 9. “Gender-affirming care” means health services or products that support and affirm the gender identity of a person, including, without limitation: 1. Treatments for gender dysphoria; 2. Gender-affirming hormone therapy; and 3. Gender-affirming surgery. Sec. 10. “Genetic data” means any data that concerns the genetic characteristics of a person. The term includes, without limitation: – 6 – - 82nd Session (2023) 1. Data directly resulting from the sequencing of all or a portion of the deoxyribonucleic acid of a person; 2. Genotypic and phenotypic information that results from analyzing the information described in subsection 1; and 3. Data concerning the health of a person that is analyzed in connection with the information described in subsection 1. Sec. 11. “Health care services or products” means any service or product provided to a person to assess, measure, improve or learn about the health of a person. The term includes, without limitation: 1. Services relating to any health condition or status, disease or diagnosis; 2. Social, psychological, behavioral or medical interventions; 3. Surgeries or other health-related procedures; 4. Medication or services related to the use or acquisition of medication; or 5. Monitoring or measurement related to bodily functions, vital signs or symptoms. Sec. 12. (Deleted by amendment.) Sec. 12.5. “Precise geolocation information” means information derived from technology, including, without limitation, latitude and longitude coordinates at the level of detail typically provided by a global positioning system, that directly identifies the specific location of a natural person with precision and accuracy within a radius of 1,750 feet. The term does not include: 1. The content of any communication; or 2. Any data generated by or connected to advanced metering infrastructure for utilities or other equipment used by a utility. Sec. 13. “Process” means any operation or set of operations performed on consumer health data. Sec. 14. “Processor” means a person who processes consumer health data on behalf of a regulated entity. Sec. 15. “Regulated entity” means any person who: 1. Conducts business in this State or produces or provides products or services that are targeted to consumers in this State; and 2. Alone or with other persons, determines the purpose and means of processing, sharing or selling consumer health data. Sec. 16. “Reproductive or sexual health care” means health care services or products that support or relate to the reproductive system or sexual well-being of a person. The term includes, without limitation, abortion, the provision of medication to induce – 7 – - 82nd Session (2023) an abortion and any medical or nonmedical services associated with an abortion. Sec. 17. “Sell” means to exchange consumer health data for money or other valuable consideration. The term does not include the exchange of consumer health data for money or other valuable consideration: 1. With a processor in a manner consistent with the purpose for which the consumer health data was collected, as disclosed to the consumer to whom the consumer health data pertains pursuant to section 22 of this act. 2. With a third party as an asset that is part of a merger, acquisition, bankruptcy or other transaction through which the third party assumes control of all or part of the assets of the regulated entity. 3. With a third party for the purpose of providing a product or service requested by the consumer to whom the consumer health data pertains. 4. With an affiliate of the person who is providing or disclosing the consumer health data. 5. As directed by the consumer to whom the consumer health data pertains or where the consumer to whom the consumer health data pertains intentionally uses the person who is providing or disclosing the consumer health data to interact with the third party to whom the consumer health data is provided or disclosed. 6. Where the consumer has intentionally made the consumer health data available to the general public through mass media that was not restricted to a specific audience. Sec. 18. “Share” means to release, disclose, disseminate, divulge, make available, provide access to, license or otherwise communicate consumer health data orally, in writing or by electronic or other means. Sec. 19. “Third party” means a person who is not a consumer, regulated entity, processor or affiliate of a regulated entity. Sec. 20. 1. The provisions of sections 2 to 34, inclusive, of this act do not apply to: (a) Any person or entity that is subject to the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, and the regulations adopted pursuant thereto. (b) A financial institution or an affiliate of a financial institution that is subject to the provisions of the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801 et seq., or any – 8 – - 82nd Session (2023) personally identifiable information regulated by that Act which is collected, maintained or sold as provided in that Act. (c) Patient identifying information, as defined in 42 C.F.R. § 2.11, that is collected, used or disclosed in accordance with 42 C.F.R. Part 2. (d) Patient safety work product, as defined in 42 C.F.R. § 3.20, that is collected, used or disclosed in accordance with 42 C.F.R. Part 3. (e) Identifiable private information, as defined in 45 C.F.R. § 46.102, that is collected, used or disclosed in accordance with 45 C.F.R. Part 46. (f) Information used or shared as part of research conducted pursuant to 45 C.F.R. Part 46 or 21 C.F.R. Parts 50 and 56 or in accordance with the version of the Guideline for Good Clinical Practice prescribed by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use published on November 9, 2016. (g) Information used only for public health activities and purposes, as described in 45 C.F.R. § 164.512(b), regardless of whether such information is subject to the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, and the regulations adopted pursuant thereto. (h) Personally identifiable information that is governed by and collected, used or disclosed pursuant to: (1) Part C of Title XI of the Social Security Act, 42 U.S.C. §§ 1320d et seq.; (2) The Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq.; or (3) The Family Educational Rights and Privacy Act of 1974, 20 U.S.C. § 1232g, and the regulations adopted pursuant thereto. (i) Information and documents created for the purposes of compliance with the federal Health Care Quality Improvement Act of 1986, 42 U.S.C. §§ 11101 et seq., and any regulations adopted pursuant thereto. (j) The collection or sharing of consumer health data where expressly authorized by any provision of federal or state law. (k) Information processed by or for any governmental or tribal entity for civic or governmental purposes and operations or related services and operations. (l) Any person who holds a nonrestricted license, as defined in NRS 463.0177, or an affiliate, as defined in NRS 463.0133, of such a person. – 9 – - 82nd Session (2023) (m) Law enforcement agencies, contractors of law enforcement agencies and law enforcement activities. (n) Information that has been de-identified in accordance with the requirements for de-identification set forth in 45 C.F.R. § 164.514. 2. A third party that obtains consumer health data from a regulated entity through a merger, acquisition, bankruptcy or other transaction through which the third party assumes control of all or part of the assets of the regulated entity is deemed to assume all obligations of the regulated entity to comply with the provisions of sections 2 to 34, inclusive, of this act. Sec. 21. 1. A regulated entity shall develop and maintain a policy concerning the privacy of consumer health data that clearly and conspicuously establishes: (a) The categories of consumer health data being collected by the regulated entity and the manner in which the consumer health data will be used; (b) The categories of sources from which consumer health data is collected; (c) The categories of consumer health data that are shared by the regulated entity; (d) The categories of third parties and affiliates with whom the regulated entity shares consumer health data; (e) The purposes of collecting, using and sharing consumer health data; (f) The manner in which consumer health data will be processed; (g) The procedure for submitting a request pursuant to section 24 of this act; (h) The process, if any such process exists, for a consumer to review and request changes to any of his or her consumer health data that is collected by the regulated entity; (i) The process by which the regulated entity notifies consumers whose consumer health data is collected by the regulated entity of material changes to the privacy policy; (j) Whether a third party may collect consumer health data over time and across different Internet websites or online services when the consumer uses any Internet website or online service of the regulated entity; and (k) The effective date of the privacy policy. 2. A regulated entity shall post conspicuously on the main Internet website maintained by the regulated entity a hyperlink to the policy developed pursuant to subsection 1 or otherwise provide – 10 – - 82nd Session (2023) that policy to consumers in a manner that is clear and conspicuous. 3. A regulated entity shall not: (a) Collect, use or share categories of consumer health data, other than those included in the privacy policy pursuant to paragraph (c) of subsection 1, without disclosing those additional categories to each consumer whose data will be collected, used or shared and obtaining the affirmative, voluntary consent of the consumer; (b) Share consumer health data with a third party or affiliate, other than those included in the privacy policy pursuant to paragraph (d) of subsection 1, without disclosing those additional third parties or affiliates to each consumer whose data will be shared and obtaining the affirmative, voluntary consent of the consumer; (c) Collect, use or share consumer health data for purposes other than those included in the privacy policy pursuant to paragraph (e) of subsection 1 without disclosing those additional purposes to each consumer whose data will be collected, used or shared and obtaining the affirmative, voluntary consent of the consumer; or (d) Enter into a contract pursuant to section 29 of this act with a processer to process consumer health data that is inconsistent with the privacy policy. Sec. 22. 1. A regulated entity shall not collect consumer health data except: (a) With the affirmative, voluntary consent of the consumer; or (b) To the extent necessary to provide a product or service that the consumer to whom the consumer health data relates has requested from the regulated entity. 2. A regulated entity shall not share consumer health data except: (a) With the affirmative, voluntary consent of the consumer to whom the consumer health data relates, which must be separate and distinct from the consent provided pursuant to subsection 1 for the collection of the data; (b) To the extent necessary to provide a product or service that the consumer to whom the consumer health data relates has requested from the regulated entity; or (c) Where required or authorized by another provision of law. 3. Any consent required by this section must be obtained before the collection or sharing, as applicable, of consumer health – 11 – - 82nd Session (2023) data. The request for such consent must clearly and conspicuously disclose: (a) The categories of consumer health data to be collected or shared, as applicable; (b) The purpose for collecting or sharing, as applicable, the consumer health data including, without limitation, the manner in which the consumer health data will be used; (c) If the consumer health data will be shared, the categories of persons and entities with whom the consumer health data will be shared; and (d) The manner in which the consumer may withdraw consent for the collection or sharing, as applicable, of consumer health data relating to the consumer and request that the regulated entity cease such collection or sharing pursuant to section 24 of this act. Sec. 23. (Deleted by amendment.) Sec. 24. 1. Except as otherwise provided in section 25 of this act, upon the request of a consumer, a regulated entity shall: (a) Confirm whether the regulated entity is collecting, sharing or selling consumer health data relating to the consumer. (b) Provide the consumer with a list of all third parties with whom the regulated entity has shared consumer health data relating to the consumer or to whom the regulated entity has sold such consumer health data. (c) Cease collecting, sharing or selling consumer health data relating to the consumer. (d) Delete consumer health data concerning the consumer. 2. A regulated entity shall establish a secure and reliable means of making a request pursuant to this section. When establishing the means for making such a request, the regulated entity must consider: (a) The need for the safe and reliable communication of such requests; and (b) The ability of the regulated entity to authenticate the identity of the consumer making the request. Sec. 25. 1. Except as otherwise provided in this section, a regulated entity shall respond to a request made pursuant to section 24 of this act without undue delay and not later than 45 days after authenticating the request. If reasonably necessary based on the complexity and number of requests from the same consumer, the regulated entity may extend the period prescribed by this section not more than an additional 45 days. A regulated entity that grants itself such an extension must, not later than – 12 – - 82nd Session (2023) 45 days after authenticating the request, provide the consumer with notice of the extension and the reasons therefor. 2. If a regulated entity is not able to authenticate a request made pursuant to section 24 of this act after making commercially reasonable efforts, the regulated entity: (a) Is not required to comply with the request; and (b) May request that the consumer provide such additional information as is reasonably necessary to authenticate the request. 3. A regulated entity: (a) Shall provide information free of charge to a consumer in response to: (1) Requests made pursuant to section 24 of this act at least twice each year; and (2) Additional requests that are not manifestly unfounded, excessive or repetitive. (b) Except as otherwise provided in paragraph (a), may charge a reasonable fee to provide information to a consumer in response to requests made pursuant to section 24 of this act that are manifestly unfounded, excessive or repetitive. 4. In any civil proceeding challenging the validity of a fee charged pursuant to paragraph (b) of subsection 3, the regulated entity has the burden of demonstrating by a preponderance of the evidence that the request to which the fee pertained was manifestly unfounded, excessive or repetitive. Sec. 26. 1. Not later than 30 days after authenticating a request made pursuant to paragraph (d) of subsection 1 of section 24 of this act for the deletion of consumer health data, a regulated entity shall, except as otherwise provided in subsection 3: (a) Delete all consumer health data described in the request from the records and network of the regulated entity; and (b) Notify each affiliate, processor, contractor or other third party with which the regulated entity has shared consumer health data of the deletion request. 2. Not later than 30 days after receiving notification of a deletion request pursuant to paragraph (b) of subsection 1, an affiliate, processor, contractor or other third party shall, except as otherwise provided in subsection 3, delete the consumer health data described in the request from the records and network of the affiliate, processor, contractor or other third party. 3. If data described in a deletion request made pursuant to paragraph (d) of subsection 1 of section 24 of this act is stored or archived on backup systems, a regulated entity or an affiliate, processor, contractor or other third party may delay the deletion of – 13 – - 82nd Session (2023) the data for not more than 2 years after the request is authenticated, as necessary to restore the archived or backup system. Sec. 27. 1. A regulated entity shall establish a process by which a consumer may appeal the refusal of the regulated entity to act on a request made pursuant to section 24 of this act. The process must be: (a) Conspicuously available on the Internet website of the regulated entity; and (b) Similar to the process for making a request pursuant to section 24 of this act. 2. Not later than 45 days after receiving an appeal pursuant to subsection 1, a regulated entity shall inform the consumer in writing of: (a) Any action taken in response to the appeal or any decision not to take such action; (b) The reasons for any such action or decision; and (c) If the regulated entity decided not to take the action requested in the appeal, the contact information for the Office of the Attorney General. Sec. 28. 1. A regulated entity shall only authorize the employees and processors of the regulated entity to access consumer health data where reasonably necessary to: (a) Further the purpose for which the consumer consented to the collection or sharing of the consumer data pursuant to section 22 of this act; or (b) Provide a product or service that the consumer to whom the consumer health data relates has requested from the regulated entity. 2. A regulated entity shall establish, implement and maintain policies and practices for the administrative, technical and physical security of consumer health data. The policies must: (a) Satisfy the standard of care in the industry in which the regulated entity operates to protect the confidentiality, integrity and accessibility of consumer health data; (b) Comply with the provisions of NRS 603A.010 to 603A.290, inclusive, where applicable; and (c) Be reasonable, taking into account the volume and nature of the consumer health data at issue. Sec. 29. 1. A processor shall only process consumer health data pursuant to a contract between the processor and a regulated entity. Such a contract must set forth the applicable processing instructions and the specific actions that the processor is – 14 – - 82nd Session (2023) authorized to take with regard to the consumer health data it possesses on behalf of the regulated entity. 2. To the extent practicable, a processor shall assist the regulated entity with which the processor has entered into a contract pursuant to subsection 1 in complying with the provisions of sections 2 to 34, inclusive, of this act. 3. If a processor processes consumer health data outside the scope of a contract described in subsection 1 or in a manner inconsistent with any provision of such a contract, the processor: (a) Is not guilty of a deceptive trade practice pursuant to section 34 of this act solely because the processor violated the requirements of this section; and (b) Shall be deemed a regulated entity for the purposes of sections 2 to 34, inclusive, of this act, for actions and omissions with regard to such consumer health data. Sec. 30. 1. A person shall not sell or offer to sell consumer health data: (a) Without the written authorization of the consumer to whom the data pertains; or (b) If the consumer provides such written authorization, in a manner that is outside the scope of or inconsistent with the written authorization. 2. A person shall not condition the provision of goods or services on a consumer authorizing the sale of consumer health data pursuant to subsection 1. 3. Written authorization pursuant to subsection 1 must be provided in a form written in plain language which includes, without limitation: (a) The name and contact information of the person selling the consumer health data; (b) A description of the specific consumer health data that the person intends to sell; (c) The name and contact information of the person purchasing the consumer health data; (d) A description of the purpose of the sale, including, without limitation, the manner in which the consumer health data will be gathered and the manner in which the person described in paragraph (c) intends to use the consumer health data; (e) A statement of the provisions of subsection 2; (f) A statement that the consumer may revoke the written authorization at any time and a description of the means established pursuant to subsection 4 for revoking the authorization; – 15 – - 82nd Session (2023) (g) A statement that any consumer health data sold pursuant to the written authorization may be disclosed to additional persons and entities by the person described in paragraph (c) and, after such disclosure, is no longer subject to the protections of this section; (h) The date on which the written authorization expires pursuant to subsection 5; and (i) The signature of the consumer to which the consumer health data pertains. 4. A person who sells consumer health data shall establish a means by which a consumer may revoke a written authorization made pursuant to subsection 1. 5. Written authorization provided pursuant to subsection 1 expires 1 year after the date on which the authorization is given. 6. A written authorization provided pursuant to subsection 1 is not valid if the written authorization: (a) Was a condition for the provision of goods or services to the consumer in violation of subsection 2; (b) Does not comply with the requirements of subsection 3; (c) Has been revoked pursuant to subsection 4; or (d) Has expired pursuant to subsection 5. 7. A person who sells consumer health data shall provide a copy of the written authorization provided pursuant to subsection 1 to the consumer who signed the written authorization and the purchaser of the consumer health data. 8. A seller and purchaser of consumer health data shall each retain a copy of the written authorization provided pursuant to subsection 1 for at least 6 years after the date on which the written authorization expired pursuant to subsection 5. Sec. 31. 1. A person shall not implement a geofence within 1,750 feet of any medical facility, facility for the dependent or any other person or entity that provides in-person health care services or products for the purpose of: (a) Identifying or tracking consumers seeking in-person health care services or products; (b) Collecting consumer health data; or (c) Sending notifications, messages or advertisements to consumers related to their consumer health data or health care services or products. 2. As used in this section: (a) “Facility for the dependent” has the meaning ascribed to it in NRS 449.0045. – 16 – - 82nd Session (2023) (b) “Geofence” means technology that uses coordinates for global positioning, connectivity to cellular towers, cellular data, radio frequency identification, wireless Internet data or any other form of detecting the physical location of a person to establish a virtual boundary with a radius of 1,750 feet or less around a specific physical location. (c) “Medical facility” has the meaning ascribed to it in NRS 449.0151. Sec. 32. (Deleted by amendment.) Sec. 33. A regulated entity shall not discriminate against a consumer for taking: 1. Any action authorized by sections 2 to 34, inclusive, of this act; or 2. Any action to enforce the provisions of sections 2 to 34, inclusive, of this act. Sec. 34. 1. Except as otherwise provided in this section and section 29 of this act, a violation of sections 2 to 34, inclusive, of this act constitutes a deceptive trade practice for the purposes of NRS 598.0903 to 598.0999, inclusive. 2. The provisions of sections 2 to 34, inclusive, of this act: (a) Do not create a private right of action; and (b) Must not be construed to affect any other provision of law. Secs. 34.1, 34.2, 34.3, 34.35, 34.4, 34.45, 34.5, 34.6, 34.7, 34.8 and 34.9. (Deleted by amendment.) Sec. 35. NRS 603A.338 is hereby amended to read as follows: 603A.338 The provisions of NRS 603A.300 to 603A.360, inclusive, do not apply to: 1. A consumer reporting agency, as defined in 15 U.S.C. § 1681a(f); 2. Any personally identifiable information regulated by the Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq., and the regulations adopted pursuant thereto, which is collected, maintained or sold as provided in that Act; 3. A person who collects, maintains or makes sales of personally identifiable information for the purposes of fraud prevention; 4. Any personally identifiable information that is publicly available; 5. Any personally identifiable information protected from disclosure under the federal Driver’s Privacy Protection Act of 1994, 18 U.S.C. §§ 2721 et seq., which is collected, maintained or sold as provided in that Act; [or] – 17 – - 82nd Session (2023) 6. Any consumer health data subject to the provisions of sections 2 to 34, inclusive, of this act; or 7. A financial institution or an affiliate of a financial institution that is subject to the provisions of the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801 et seq., or any personally identifiable information regulated by that Act which is collected, maintained or sold as provided in that Act. Sec. 36. This act becomes effective on March 31, 2024. 20 ~~~~~ 23