Bill > S250

This bill establishes the Consumer Health Data Act in Massachusetts, creating comprehensive privacy protections for consumers' health-related personal information. The legislation defines "Consumer Health Data" broadly, including information about an individual's physical or mental health conditions, medical treatments, medication use, health service research, and even derived or inferred health-related data. The bill requires businesses (called "Regulated Entities") to obtain explicit, informed consent before collecting or sharing such data, mandating clear privacy policies that detail what data is collected, from where, and with whom it might be shared. Consumers are granted specific rights, including the ability to know what health data is being collected about them, withdraw consent, and request deletion of their data. The bill prohibits selling consumer health data without a valid, detailed authorization from the consumer and requires businesses to maintain robust data security practices. Enforcement is exclusively handled by the Massachusetts Attorney General, who must provide a 45-day notice period for businesses to cure any violations before initiating legal action. The legislation does not apply to health information already protected by HIPAA and includes exemptions for legally required disclosures. Notably, the bill does not allow private lawsuits, making the Attorney General the sole enforcement mechanism for these consumer protections.

Budget and Finance, Labor and Employment

https://malegislature.gov/Bills/194/S250