Bill > S0074

This bill proposes comprehensive privacy protections for consumer health data in Vermont, establishing the "Vermont My Health My Data Act" with significant new requirements for businesses that collect, use, or share sensitive health information. The legislation defines "consumer health data" broadly to include a wide range of personal health-related information, from medical treatments and diagnoses to reproductive health services and location data. Key provisions require businesses to obtain explicit, informed consent before collecting or sharing consumer health data, provide clear privacy policies, and give consumers the right to access, delete, and withdraw consent for their health data. The bill prohibits selling consumer health data without a separate, signed authorization and makes it unlawful to use geofencing technology near healthcare facilities to track individuals. Businesses must implement robust data security practices, limit employee access to health data, and ensure that any third-party processors adhere to strict guidelines. The law applies to businesses operating in Vermont or targeting Vermont consumers, with some exemptions for certain types of health information and research. Violations will be treated as consumer protection offenses, enforceable by the Attorney General, and the law is set to take effect on January 1, 2026, giving businesses time to adjust their data handling practices.

Health and Social Services

https://legislature.vermont.gov/bill/status/2026/S.74