The bill S.74, known as the "Vermont My Health My Data Act," aims to strengthen the regulation of consumer health data in Vermont by amending 18 V.S.A. chapter 42B. It establishes a new subchapter that emphasizes privacy as a fundamental right for Vermonters, requiring explicit consumer consent for the collection and sharing of health data. The bill prohibits the sale of health data without valid authorization and restricts the use of geofencing technology around healthcare facilities. It also introduces definitions for key terms related to consumer health data, ensuring clarity in the legislation's scope and intent.

Additionally, the bill mandates that regulated entities and small businesses maintain a consumer health data privacy policy, outlining data collection practices and third-party sharing. It grants consumers rights to confirm data collection, withdraw consent, and request deletion of their health data. The bill requires processors to handle consumer health data according to binding instructions and prohibits the sale of such data without clear consumer authorization. Violations of these provisions will be treated as violations of the Consumer Protection Act, with enforcement by the Attorney General. The act is set to take effect on January 1, 2026.

Statutes affected:
As Introduced: 18-42B