Nevada Governor Joe Lombardo recently signed into law a sweeping and restrictive consumer health data privacy law that requires covered entities (defined as any person who conducts business in the state or produces or provides products or services that are targeted to consumers in Nevada) to provide privacy rights to consumers who provide health data to companies not covered by other laws that apply to health care providers.

The broad law defines “consumer health data”, as “personally identifiable information that is linked or reasonably capable of being linked to a consumer and that a regulated entity uses to identify the past, present or future health status of the consumer,” and includes a long list of data elements including health condition, status, disease or diagnosis, social psychological, behavioral or medical intervention, surgeries, use or acquisition of medication, bodily functions, vital signs or symptoms, reproductive or sexual health care, gender-affirming care, biometric data, genetic data, precise geolocation data, and any data that is derived or extrapolated from information that is not consumer health data through an algorithm, machine learning, or any other means, but excludes shopping habits and gaming information.

The law requires covered entities to make available to consumers a privacy policy on the internet regarding its privacy of consumer health data, prohibits an entity from collecting or sharing consumer health data without affirmative, voluntary consent of a consumer, requires the entity to establish a process to obtain access to (and an appeal process for responding to) consumer requests, limits the entity from processing the data, prohibits entities from selling consumer health data, prohibits geofencing and prohibits discrimination against individuals for exercising their rights under the law. The law provides for a civil penalty of not more than $5,000 per violation and includes criminal provisions. It becomes effective on March 31, 2024.