Bill > H461

This bill establishes the Consumer Health Data Act in Massachusetts, creating comprehensive privacy protections for consumers' health-related personal information. The legislation defines "Consumer Health Data" broadly, covering a wide range of personal health information, including medical conditions, treatments, bodily functions, location data used for health services, and even derived or inferred health-related data. Regulated entities (businesses operating in Massachusetts or targeting Massachusetts consumers) must obtain explicit, informed consent before collecting or sharing this data, and must maintain a clear privacy policy that details what data is collected, from where, and with whom it might be shared. Consumers are granted several key rights, including the right to know what health data is being collected about them, to withdraw consent, and to request deletion of their data. The bill prohibits selling consumer health data without a valid, detailed authorization from the consumer, and requires businesses to implement robust data security practices. Enforcement is exclusively vested with the Massachusetts Attorney General, who must provide a 45-day notice period for entities to cure any violations before initiating legal action. The law exempts certain health information already protected by federal HIPAA regulations and does not create a private right of action, meaning consumers cannot sue directly for violations. The bill aims to provide strong privacy protections for Massachusetts residents' sensitive health information in an increasingly data-driven digital landscape.

Labor and Employment

https://malegislature.gov/Bills/194/H461