An act relating to the collection, sharing, and selling of consumer health data
Impact
If enacted, S0173 will impose significant obligations on regulated entities, such as businesses that collect, share, or sell health data. These organizations will need to implement robust privacy policies, limit access to consumer data, and ensure that they provide consumers with the ability to delete their data. Additionally, companies must ensure that any third parties with whom they share health data also adhere to these privacy requirements. This could lead to a substantial shift in how businesses operate in relation to consumer health information, creating a higher standard of accountability for data privacy.
Summary
S0173, also known as the Vermont My Health My Data Act, aims to establish regulations governing the collection, sharing, and selling of consumer health data in Vermont. The bill seeks to enhance privacy protections for individuals by requiring clear disclosures and obtaining affirmative consent from consumers before their health data can be collected or shared. It addresses gaps in existing federal legislation like HIPAA, which does not cover health data collected by non-healthcare entities. This new framework is intended to safeguard Vermont residents' sensitive health information and reinforce consumer trust in how their data is handled.
Contention
The legislation may encounter opposition from businesses concerned about the potential regulatory burden and the impacts on their operations. The defined requirements for obtaining consent and the implications of liability for data violations may raise concerns among small businesses and tech companies. Some stakeholders may argue that while consumer data protection is essential, overly stringent regulations could stifle innovation or lead to unintended consequences in data accessibility for healthcare providers. The balance between protecting consumer privacy and ensuring the efficient operation of businesses in the health data ecosystem will need to be carefully navigated.
Minnesota Consumer Data Privacy Act modified to make consumer health data a form of sensitive data, and additional protections added for sensitive data.
Classifies, research, intent and interest in healthcare services as protected healthcare data. Adds responsibilities for regulated entities that seek to collect and share consumer data including a requirement for specific and conspicuous consumer consent.