SB 370

Nevada's consumer health data law (Senate Bill 370, 2023, codified in NRS Chapter 603A) protects health data held outside HIPAA. It follows the approach of Washington's My Health My Data Act, with consent to collect and share, a written authorization to sell, geofencing limits and consumer rights, but it is narrower in places and, importantly, has no private right of action.

It took effect on 31 March 2024.

• Regulated entities that conduct business in Nevada or produce or provide products or services targeted to Nevada consumers, and that alone or jointly determine the purpose and means of processing consumer health data.
• Consumer health data is personally identifiable information linked or reasonably linkable to a consumer that a regulated entity uses to identify their past, present or future health status.
• Data covered by HIPAA and certain other laws is exempt, as are some purposes such as security and legal compliance.

Consumers can confirm whether their consumer health data is collected, shared or sold and see a list of the third parties that received it, ask for deletion, and withdraw consent. Regulated entities must respond within 45 days, extendable once, and provide an appeal process.

Enforced by the Attorney General; a violation is treated as a deceptive trade practice. There is no private right of action.

1. Map consumer health data you use to identify health status, including from apps and websites.
2. Publish a consumer health data privacy policy.
3. Get consent to collect and separate consent to share, where no exception applies.
4. Hold a written authorization before any sale.
5. Remove geofences around health care facilities.
6. Build one health data program that meets Washington's stricter rules and covers Nevada at the same time.