Bill Summary – FastDemocracy

BILL AS INTRODUCED                                                        S.173
                                                              Page 1 of 29
                                      S.173
 Introduced by Senator Lyons
 Referred to Committee on
 Date:
 Subject: Health; health information; data privacy
 Statement of purpose of bill as introduced: This bill proposes to regulate the
 collection, sharing, and selling of consumer health data in Vermont.
    An act relating to the collection, sharing, and selling of consumer health
    data
 It is hereby enacted by the General Assembly of the State of Vermont:
 Sec. 1. 18 V.S.A. chapter 42B is amended to read:
                        42B. HEALTH CARE PRIVACY
           Subchapter 1. Disclosure of Protected Health Information
 § 1881. DISCLOSURE OF PROTECTED HEALTH INFORMATION
         PROHIBITED
                                       ***
                Subchapter 2. Vermont My Health My Data Act
 § 1891. SHORT TITLE
    This subchapter shall be known and may be cited as the “Vermont My
 Health My Data Act.”
                                                                       VT LEG #372126 v.1
     BILL AS INTRODUCED                                                        S.173
                                                              Page 2 of 29
 § 1892. FINDINGS AND INTENT
    (a) Findings. The General Assembly finds that:
       (1) The residents of Vermont regard their privacy as a fundamental right
 and an essential element of their individual freedom. Fundamental privacy
 rights have long been and continue to be integral to protecting Vermonters and
 to safeguarding our democratic republic.
       (2) Information related to an individual’s health conditions or attempts
 to obtain health care services is among the most personal and sensitive
 categories of data collected. Vermonters expect that their health data is
 protected under laws like the Health Insurance Portability and Accountability
 Act of 1996 (HIPAA). However, HIPAA only covers health data collected by
 specific health care entities, including most health care providers. Health data
 collected by noncovered entities, including certain applications and websites,
 are not afforded the same protections. This act works to close the gap between
 consumer knowledge and industry practice by providing stronger privacy
 protections for all of Vermont consumers’ health data.
    (b) Intent. By enacting this act, it is the intent of the General Assembly to
 provide heightened protections for Vermonters’ health data by:
       (1) requiring additional disclosures and consumer consent regarding the
 collection, sharing, and use of their health data;
                                                                       VT LEG #372126 v.1
     BILL AS INTRODUCED                                                         S.173
                                                               Page 3 of 29
       (2) empowering consumers with the right to have their health data
 deleted;
       (3) prohibiting the selling of consumer health data without valid
 authorization signed by the consumer; and
       (4) making it unlawful to utilize a geofence around a facility that
 provides health care services.
 § 1893. DEFINITIONS
    As used in this subchapter:
       (1) “Abortion” means any medical treatment intended to induce the
 termination of, or to terminate, a clinically diagnosable pregnancy except for
 the purpose of producing a live birth.
       (2) “Affiliate” means a legal entity that shares common branding with
 another legal entity and controls, is controlled by, or is under common control
 with another legal entity. For purposes of this definition, “control” or
 “controlled” means any one or more of the following:
            (A) ownership of, or the power to vote, more than 50 percent of the
 outstanding shares of any class of voting security of a company;
            (B) control in any manner over the election of a majority of the
 directors or of individuals exercising similar functions; or
            (C) the power to exercise controlling influence over the management
 of a company.
                                                                        VT LEG #372126 v.1
     BILL AS INTRODUCED                                                          S.173
                                                                Page 4 of 29
       (3) “Authenticate” means to use reasonable means to determine that a
 request to exercise any of the rights afforded in this chapter is being made by
 or on behalf of the consumer who is entitled to exercise those consumer rights
 with respect to the consumer health data at issue.
       (4) “Biometric data” means data that is generated from the measurement
 or technological processing of an individual’s physiological, biological, or
 behavioral characteristics and that identifies a consumer, whether individually
 or in combination with other data. Biometric data includes:
          (A) imagery of the iris, retina, fingerprint, face, hand, palm, vein
 patterns, and voice recordings, from which an identifier template can be
 extracted; and
          (B) keystroke patterns or rhythms and gait patterns or rhythms that
 contain identifying information.
       (5) “Collect” means to buy, rent, access, retain, receive, acquire, infer,
 derive, or otherwise process consumer health data in any manner.
       (6)(A) “Consent” means a clear affirmative act that signifies the
 consumer’s freely given, specific, informed, opt-in, voluntary, and
 unambiguous agreement, which may include written consent provided by
 electronic means.
          (B) “Consent” shall not be obtained by:
                                                                        VT LEG #372126 v.1
     BILL AS INTRODUCED                                                          S.173
                                                                Page 5 of 29
               (i) a consumer’s acceptance of a general or broad terms-of-use
 agreement or a similar document that contains descriptions of personal data
 processing along with other unrelated information;
               (ii) a consumer hovering over, muting, pausing, or closing a given
 piece of content; or
               (iii) a consumer’s agreement obtained through the use of deceptive
 designs.
       (7)(A) “Consumer” means a natural person who meets one or both of
 the following conditions:
               (i) the person is a Vermont resident; or
               (ii) the person’s consumer health data is collected in Vermont.
            (B) “Consumer” means a natural person who acts only in an
 individual or household context, however identified, including by any unique
 identifier. The term does not include an individual acting in an employment
 context.
       (8)(A) “Consumer health data” means personal information that is
 linked or reasonably linkable to a consumer and that identifies the consumer’s
 past, present, or future physical or mental health status.
            (B) For purposes of this definition, physical or mental health status
 includes:
               (i) individual health conditions, treatment diseases, or diagnosis;
                                                                         VT LEG #372126 v.1
     BILL AS INTRODUCED                                                          S.173
                                                                Page 6 of 29
             (ii) social, psychological, behavioral, and medical interventions;
             (iii) health-related surgeries or procedures;
             (iv) use or purchased of prescribed medication;
             (v) bodily functions, vital signs, symptoms, or measurements of
 the information described in this subdivision (B);
             (vi) diagnoses or diagnostic testing, treatment, or medication;
             (vii) gender-affirming care information;
             (viii) reproductive or sexual health information;
             (ix) biometric data;
             (x) genetic data;
             (xi) precise location information that could reasonably indicate a
 consumer’s attempt to acquire or receive health services or supplies;
             (xii) data that identifies a consumer seeking health care services;
 or
             (xiii) any information that a regulated entity or a small business,
 or its respective processor, processes to associate or identify a consumer with
 the data described in subdivisions (i)–(xii) of this subdivision (B) that is
 derived or extrapolated from nonhealth information, such as proxy, derivative,
 inferred, or emergency data by any means, including algorithms or machine
 learning.
                                                                         VT LEG #372126 v.1
     BILL AS INTRODUCED                                                           S.173
                                                                 Page 7 of 29
           (C) “Consumer health data” does not include personal information
 that is used to engage in public or peer-reviewed scientific, historical, or
 statistical research in the public interest that adheres to all other applicable
 ethics and privacy laws and is approved, monitored, and governed by an
 institutional review board, human subjects research ethics review board, or a
 similar independent oversight entity that determines that the regulated entity or
 the small business has implemented reasonable safeguards to mitigate privacy
 risks associated with research, including any risks associated with
 reidentification.
       (9) “Deceptive design” means a user interface designed or manipulated
 with the effect of subverting or impairing user autonomy, decision making, or
 choice.
       (10) “Deidentified data” means data that cannot reasonably be used to
 infer information about, or otherwise be linked to, an identified or identifiable
 consumer, or a device linked to such consumer, if the regulated entity or the
 small business that possesses the data does all of the following:
           (A) takes reasonable measures to ensure that the data cannot be
 associated with a consumer;
           (B) publicly commits to process the data only in a deidentified
 fashion and not to attempt to reidentify the data; and VT LEG #372126 v.1
     BILL AS INTRODUCED                                                         S.173
                                                               Page 8 of 29
          (C) contractually obligates any recipients of the data to satisfy the
 criteria set forth in this subdivision (10).
       (11) “Gender-affirming care information” means personal information
 relating to seeking or obtaining past, present, or future gender-affirming health
 care services. “Gender-affirming care information” includes:
          (A) precise location information that could reasonably indicate a
 consumer’s attempt to acquire or receive gender-affirming health care services;
          (B) efforts to research or obtain gender-affirming health care
 services; or
          (C) any gender-affirming care information that is derived,
 extrapolated, or inferred, including from nonhealth information such as proxy,
 derivative, inferred, emergent, or algorithmic data.
       (12) “Gender-affirming health care services” has the same meaning as in
 1 V.S.A. § 150.
       (13) “Genetic data” means any data, regardless of its format, that
 concerns a consumer’s genetic characteristics. “Genetic data” includes:
          (A) raw sequence data that result from the sequencing of a
 consumer’s complete extracted deoxyribonucleic acid (DNA) or a portion of
 the extracted DNA;
          (B) genotypic and phenotypic information that results from analyzing
 the raw sequence data; and VT LEG #372126 v.1
     BILL AS INTRODUCED                                                           S.173
                                                                 Page 9 of 29
          (C) self-reported health data that a consumer submits to a regulated
 entity or a small business and that is analyzed in connection with the
 consumer’s raw sequence data.
       (14) “Geofence” means technology that uses global positioning
 coordinates, cell tower connectivity, cellular data, radio frequency
 identification, Wi-Fi data, or any other form of spatial or location detection,
 individually or in combination, to establish a virtual boundary around a
 specific physical location or to locate a consumer within a virtual boundary.
 For purposes of this definition, “geofence” means a virtual boundary that is
 2,000 feet or less from the perimeter of the physical location.
       (15) “Health care service” means any service provided to a person to
 assess, measure, improve, or learn about a person’s mental or physical health,
 including:
          (A) individual health conditions, status, diseases, or diagnoses;
          (B) social, psychological, behavioral, and medical interventions;
          (C) health-related surgeries or procedures;
          (D) use or purchase of medication;
          (E) bodily functions, vital signs, symptoms, or measurements of the
 information described in this subdivision (15);
          (F) diagnoses or diagnostic testing, treatment, or medication;
          (G) reproductive health services; or VT LEG #372126 v.1
     BILL AS INTRODUCED                                                        S.173
                                                             Page 10 of 29
          (H) gender-affirming health care services.
       (16) “Homepage” means the introductory page of an internet website
 and any internet web page on which personal information is collected. In the
 case of an online service such as a mobile application, “homepage” means the
 application’s platform page or download page, and a link within the
 application, such as from the application configuration or the “about,”
 “information,” or “settings” page.
       (17) “Person” means, where applicable, a natural person, corporation,
 trust, unincorporated association, or partnership. The term does not include a
 government agency, tribal nation, or a contracted service provider when
 processing consumer health data on behalf of a government agency.
       (18)(A) “Personal information” means information that identifies or is
 reasonably capable of being associated or linked, directly or indirectly, with a
 particular consumer. “Personal information” includes data associated with a
 persistent unique identifier, such as a cookie ID, an IP address, a device
 identifier, or any other form of persistent unique identifier.
          (B) “Personal information” does not include publicly available
 information or deidentified data.
       (19) “Precise location information” means information derived from
 technology, including global positioning system level latitude and longitude
 coordinates and other mechanisms, that directly identifies the specific location VT LEG #372126 v.1
     BILL AS INTRODUCED                                                        S.173
                                                             Page 11 of 29
 of an individual with precision and accuracy within a radius of 1,750 feet.
 “Precise location information” does not include the content of communications
 or any data generated by or connected to advanced utility metering
 infrastructure systems or equipment for use by a utility.
       (20) “Process” or “processing” means any operation or set of operations
 performed on consumer health data.
       (21) “Processor” means a person who processes consumer health data
 on behalf of a regulated entity or a small business.
       (22)(A) “Publicly available information” means information that:
             (i) is lawfully made available through federal, state, or municipal
 government records or widely distributed media; and
             (ii) a regulated entity or a small business has a reasonable basis to
 believe a consumer has lawfully made available to the general public.
          (B) “Publicly available information” does not include any biometric
 data collected about a consumer by a business without the consumer’s consent.
       (23)(A) “Regulated entity” means any legal entity that:
             (i) conducts business in Vermont, or produces or provides
 products or services that are targeted to consumers in Vermont; and
             (ii) alone or jointly with others, determines the purpose and means
 of collecting, processing, sharing, or selling of consumer health data.
                                                                       VT LEG #372126 v.1
     BILL AS INTRODUCED                                                           S.173
                                                                Page 12 of 29
             (B) “Regulated entity” does not mean government agencies or
 contracted service providers when processing consumer health data on behalf
 of a government agency.
       (24)(A) “Reproductive or sexual health information” means personal
 information relating to seeking or obtaining past, present, or future
 reproductive or sexual health services.
             (B) “Reproductive or sexual health information” includes:
                (i) precise location informat