June 28, 2023
Nevada has taken a significant step toward safeguarding consumer health data with the enactment of the Consumer Health Data Privacy Law, Senate Bill 370 (SB370). This landmark legislation, signed into law by Governor Joe Lombardo on June 16, 2023, aims to enhance data privacy rights for individuals in Nevada and ensure greater control over their personal health information.
With its comprehensive provisions, SB370 joins a growing number of state-level initiatives focused on consumer privacy. According to the International Association of Privacy Professionals, California, Colorado, Connecticut, Indiana, Iowa, Montana, Tennessee, Texas, Utah, and Virginia have paved the way for strengthening consumer health privacy laws in their states.
Table of Contents
Nevada’s New Law on Health Data Privacy Strengthens Consumer Rights
SB370 amends existing legislation to impose more stringent requirements on businesses operating in Nevada or collecting consumer health data within the state. It establishes clear guidelines for the collection, sharing, and selling of consumer health data, granting consumers greater transparency, control, and protection over their sensitive health information.
Consumer Rights Under the New Consumer Privacy Law in Nevada Healthcare
The Consumer Health Data Privacy Law protects consumer health data. This means any personal information that is linked or can be linked to a consumer. It is also information that covered businesses can use to identify a consumer’s health status.
According to The National Law Review, consumer data includes information on a consumer’s:
- health condition, status, disease, or diagnosis,
- social, psychological, behavioral, or medical interventions
- surgeries and other health-related procedures
- use and acquisition of medication,
- reproductive health care
- gender-affirming care
- bodily functions, vital signs, and symptoms
Moreover, consumer data includes biometric or genetic data related to the above information, details about a consumer’s precise geolocation, and any information derived or extrapolated from data that is not considered consumer health data. The latter includes various data generated through algorithms, machine learning, or other means.
The law grants consumers several essential rights regarding their health data. Like the California Consumer Privacy Act, these rights empower individuals and give them more control over their personal information.
Key provisions include:
- Right to confirmation: Consumers have the right to confirm whether a covered business is collecting, sharing, or selling their health data.
- Right to access: Consumers can request a comprehensive list of all third parties with whom the business has shared or sold their health data.
- Right to opt-out: Consumers possess the right to request that a business stops collecting, sharing, or selling their health data.
- Right to deletion: Consumers can request the deletion of their health data from the records and networks of covered businesses.
Nevada New Consumer Health Data Privacy Law Compliance: Obligations for Covered Businesses
SB370 places various obligations on covered businesses to ensure compliance with the new health data privacy law. Some key requirements include:
- Affirmative consent: Covered businesses must obtain voluntary, affirmative consent from consumers before collecting or sharing their health data, except when necessary to provide requested products or services. They should also stop collecting, sharing, or selling a consumer’s health data upon their request.
- Privacy policies: Covered businesses must develop and maintain a privacy policy that clearly outlines the categories of consumer health data collected, the purpose of data usage, sources of data collection, categories of third parties with whom the data is shared, the procedure for submitting a request, how a consumer can review and request changes to their data, how they will notify consumers of any changes to the privacy policy, and the effective date of the privacy policy.
- Security measures: Covered businesses are required to establish, implement, and maintain policies and practices for the secure handling and storage of consumer health data, ensuring its protection against unauthorized access or disclosure. Employees and any other entity that processes the data of covered businesses should only access the necessary information to perform the purpose of the data collection or to provide the product or service the consumer has asked for.
- Data deletion: Covered businesses must delete consumer data upon request.
- Identifying and tracking consumers: Covered businesses may not put up a geofence within 1,750 of any medical facility to track or identify consumers seeking health care.
In addition, covered businesses must respond promptly to requests no later than 45 days after the request is authenticated. The 45-day limit starts as soon as the request is received, not when it is authenticated.
Effective Date and Penalties Under SB370
SB370 is set to become law on March 31, 2024. The law grants enforcement authority to the Nevada Attorney General, who will oversee its implementation and address any violations. It is important to note that there is no private right of action under this law, meaning consumers cannot bring individual lawsuits against non-compliant businesses. However, the Attorney General has the power to impose penalties and take legal action against entities that fail to comply with the law’s provisions.
Nevada New Consumer Health Data Privacy Law’s Impact on Businesses
The Nevada Consumer Health Data Privacy Law imposes significant responsibilities on covered businesses. A careful review of the law is essential to determine if a company falls under the definition of a regulated entity or qualifies for an exemption.
Businesses affected by SB370 must ensure compliance with its provisions, including obtaining affirmative consent, developing privacy policies, implementing robust security measures, and promptly responding to consumer requests. As data privacy laws continue to evolve, organizations should stay updated on current regulations and prioritize protecting consumer health data.
