The proposed "Sensitive Healthcare Information Privacy Act" introduces new regulations in Title 23 of the General Laws to protect consumer health data, particularly concerning reproductive and gender-affirming care. The bill establishes clear definitions for key terms and mandates that regulated entities obtain explicit, informed, and voluntary consent from consumers before collecting or sharing their health data. It outlines the requirements for valid authorizations, including detailed information about the data being shared, the parties involved, and the consumer's rights regarding revocation and redisclosure. Additionally, the bill prohibits the use of geofences around healthcare facilities to track consumers or collect their health data.

The legislation delineates the responsibilities of regulated entities and small businesses in handling consumer health data, requiring them to maintain a consumer health data privacy policy, restrict access to data, and implement security practices. Consumers are granted rights to confirm whether their health data is being collected or shared, withdraw consent, and request deletion of their data, with entities required to comply within specified timeframes. The bill includes enforcement provisions, allowing individuals to bring civil actions for violations and enabling the attorney general to pursue enforcement actions for deceptive trade practices. It also specifies exemptions for certain health information governed by federal laws and imposes penalties for non-compliance, with a record retention requirement for authorizations lasting six years. The act is set to take effect on January 1, 2027, for regulated entities and April 1, 2027, for small businesses.