Bill > H7357

This bill, titled the "Sensitive Healthcare Information Privacy Act," aims to protect sensitive health data, specifically concerning reproductive and gender-affirming care, by establishing new privacy rules for entities that collect, process, share, or sell this information. Key provisions include requiring organizations to obtain explicit, opt-in consent from consumers before collecting such data, and prohibiting the sale of this data without separate, specific authorization from the consumer. The bill defines "consumer health data" broadly to include information related to gender-affirming care and reproductive or sexual health, as well as any data derived or inferred from it. It grants consumers rights to access, correct, and delete their data, and to withdraw consent. The act also mandates that organizations maintain a clear privacy policy detailing data collection and sharing practices, implement reasonable data security measures, and prohibits the use of geofencing around facilities providing reproductive or gender-affirming care to track or collect data from individuals seeking these services. Enforcement mechanisms include allowing individuals to bring civil lawsuits for violations, with potential for attorney's fees, and empowering the Attorney General to pursue enforcement actions, treating violations as deceptive trade practices. The act includes various exemptions for data already protected under federal laws like HIPAA, research data, and certain other health-related information.