H.B. 754
GENERAL ASSEMBLY OF NORTH CAROLINA
Apr 18, 2023
SESSION 2023 HOUSE PRINCIPAL CLERK
H D
HOUSE BILL DRH40390-MG-24A
Short Title: Req. Consent to Monetize Protected Hlth Info. (Public)
Sponsors: Representative G. Brown.
Referred to:
1 A BILL TO BE ENTITLED
2 AN ACT ENHANCING PROTECTIONS AGAINST THE USE, DISCLOSURE, OR SALE OF
3 PROTECTED HEALTH INFORMATION BY REQUIRING A NOTICE OF DATA SALE
4 OR TRANSFER.
5 The General Assembly of North Carolina enacts:
6 SECTION 1. G.S. 90-414.3(3) reads as rewritten:
7 "(3) Covered entity. – Any of the following:
8 a. Any entity described in 45 C.F.R. § 160.103 or any 45 C.F.R. §
9 160.103.
10 b. Any other facility or practitioner licensed by the State to provide health
11 care healthcare services.
12 c. Any other entity that engages in the practice of assembling, collecting,
13 analyzing, using, evaluating, storing, or transmitting protected health
14 information."
15 SECTION 2. Article 29B of Chapter 90 of the General Statutes is amended by adding
16 a new section to read:
17 "§ 90-414.6A. Notice of data sale or transfer; exemption for clinical research involving
18 human subjects.
19 (a) A covered entity may not use or disclose a patient's protected health information for
20 any purpose outside of the normal course of providing patient care, billing or paying for
21 healthcare services, or determining insurance coverage for healthcare services, unless the covered
22 entity first does both of the following:
23 (1) Notifies the patient, electronically or in writing and separate from the notice
24 of privacy practice required under the HIPAA Privacy Rule, of the covered
25 entity's intent to distribute or sell the patient's protected health information.
26 The notice required by this section shall meet all of the following criteria:
27 a. Be limited to 250 words.
28 b. Provide an explanation about how the patient's protected health
29 information will be distributed or sold outside of the normal course of
30 care.
31 c. Clearly state that the patient's treatment or access to care is not
32 contingent on the patient's agreement to the terms of the notice of data
33 sale or transfer.
34 (2) Obtains the patient's agreement, electronically or in writing, to the notice of
35 data sale or transfer required by subdivision (1) of this section.
*DRH40390-MG-24A*
 General Assembly Of North Carolina Session 2023
1 (b) A covered entity may not make a patient's treatment, access to care, access to a patient
2 portal, or coverage for care contingent on the patient's agreement to the terms of a notice of data
3 sale or transfer.
4 (c) The notice of data sale or transfer required by this section does not apply to
5 information captured in the process of clinical research involving the participation of human
6 subjects. For the purpose of this section, information captured in the process of clinical research
7 involving the participation of human subjects means personal data collected, used, or shared in
8 academic, private, or public research involving human subjects conducted in accordance with the
9 good clinical practice guidelines issued by The International Council for Harmonisation of
10 Technical Requirements for Pharmaceuticals for Human Use."
11 SECTION 3. This act becomes effective January 1, 2024, and applies to acts
12 occurring on or after that date.
Page 2 DRH40390-MG-24A


Statutes affected:
Filed: 90-414.3
Edition 1: 90-414.3