Consumer health data privacy laws: what to check

Washington’s My Health My Data Act is not the only state law written for health data that sits outside HIPAA. Nevada passed its own consumer health data law in 2023, and Connecticut added consumer health data sections to its general data privacy act the same year. Both reach businesses outside their borders that offer products or services to their residents, and both put limits on things marketing teams do every day: website tracking, ad audiences, location targeting and selling data. This guide walks through what the Nevada and Connecticut statutes say, in their own words where possible, where they differ from Washington, and what a health business should check.

Two neighboring topics have their own guides and are not repeated here. The Washington law, including its private right of action and its data-level HIPAA exemption, is covered in Washington’s My Health My Data Act. How pixels, tags and session recording tools send visitor data to third parties is covered in tracking pixels on practice websites. For how these geofencing limits compare with Washington and New York, and what a practice can still target in local ads, see our guide to geofencing ads near health facilities.

This is general information, not legal advice. Sources cited were checked on October 29, 2026: Nevada Revised Statutes chapter 603A, sections 603A.400 to 603A.550, as posted by the Nevada Legislature (page revised April 15, 2026), and Senate Bill 370 of the 2023 session as enrolled (section 36, effective March 31, 2024); Connecticut General Statutes sections 42-515 to 42-526, as posted by the Connecticut General Assembly (revised to January 1, 2025) and in its 2026 Supplement (amendments by Public Act 25-113 effective July 1, 2026); RCW chapter 19.373 and the Washington Attorney General’s FAQ for comparison; and 45 CFR 160.103. State laws in this area change, and other states may have their own. The states covered here are not a complete list. Have a privacy attorney review your facts before you rely on any of it.

Why these laws matter to health businesses

HIPAA protects health information held by covered entities and their business associates. Health marketing data can fall outside that protection: data about website visitors who have not become patients, data held by businesses that are not covered entities at all, and data gathered by ad and analytics vendors. State consumer health data laws are aimed at that gap. They define health data broadly, they require consent before collecting or sharing it, and they restrict location-based advertising around places where people get care.

For a marketing plan, the practical effect is that the question “is this HIPAA data?” is no longer the only question. A wellness studio, a cash-pay clinic that does not bill insurance electronically, a supplement store, a health app or a coaching program may have no HIPAA duties and still be squarely inside a state consumer health data law. A HIPAA covered practice has to look at how each state words its exemption, because the states do not word it the same way.

Nevada: NRS 603A.400 to 603A.550

Nevada’s law was enacted as Senate Bill 370 in 2023 and is codified in chapter 603A of the Nevada Revised Statutes, under the heading Consumer Health Data. Section 36 of the enrolled bill says the act became effective on March 31, 2024.

Who it covers. NRS 603A.465 defines a regulated entity as any person who conducts business in Nevada or produces or provides products or services that are targeted to consumers in Nevada, and who, alone or with others, determines the purpose and means of processing, sharing or selling consumer health data. A business located elsewhere that advertises to Nevada residents or serves them online should not assume the law stops at the state line.

What counts as consumer health data. NRS 603A.430 defines it as personally identifiable information that is linked or reasonably capable of being linked to a consumer and that a regulated entity uses to identify the past, present or future health status of the consumer. The listed examples include information about any health condition, disease or diagnosis; social, psychological, behavioral or medical interventions; surgeries or other health-related procedures; the use or acquisition of medication; and bodily functions, vital signs or symptoms. It also covers precise geolocation information that a regulated entity uses to indicate an attempt to receive health care services or products, and health information derived or extrapolated from other data, including inferences made by an algorithm or machine learning. The definition excludes information used to identify the shopping habits or interests of a consumer, if that information is not used to identify the specific past, present or future health status of the consumer.

A privacy policy linked from the main website. NRS 603A.495 requires a regulated entity to keep a policy on the privacy of consumer health data that clearly and conspicuously sets out, among other things, the categories of data collected and how they will be used, the sources, the categories shared, the categories of third parties and affiliates it shares with, the purposes, how consumers make requests, whether a third party may collect consumer health data over time and across websites when the consumer uses the entity’s site, and the policy’s effective date. The entity must post a hyperlink to that policy conspicuously on its main website, or otherwise provide it in a clear and conspicuous way. Our guide to a practice website privacy policy covers the general privacy policy a site needs.

Consent to collect, and separate consent to share. Under NRS 603A.500, a regulated entity may not collect consumer health data except with the affirmative, voluntary consent of the consumer, or to the extent necessary to provide a product or service the consumer requested. It may not share consumer health data except with consent that is separate and distinct from the consent to collect, to the extent necessary to provide what the consumer requested, or where another law requires or authorizes it. Consent must come before the collection or sharing, and the request must clearly and conspicuously disclose the categories of data, the purpose, the categories of recipients if the data will be shared, and how the consumer can withdraw consent.

Consumer requests. NRS 603A.505 lets a consumer ask a regulated entity to confirm whether it collects, shares or sells their consumer health data, to provide a list of the third parties it shared or sold the data to, to stop collecting, sharing or selling it, and to delete it. The entity must set up a secure and reliable way to make those requests.

Selling data needs a signed written authorization. NRS 603A.535 says a person shall not sell or offer to sell consumer health data without the written authorization of the consumer, and lists what the authorization must contain, including the names of the seller and buyer, the specific data, the purpose, an expiration date and the consumer’s signature. A person may not condition goods or services on the consumer agreeing to a sale.

No geofences near places that provide in-person care. NRS 603A.540 says a person shall not implement a geofence within 1,750 feet of any medical facility, facility for the dependent or any other person or entity that provides in-person health care services or products, for the purpose of identifying or tracking consumers seeking in-person care, collecting consumer health data, or sending notifications, messages or advertisements related to their consumer health data or health care services or products.

Enforcement. NRS 603A.550 makes a violation a deceptive trade practice under Nevada’s deceptive trade practices statutes and says the consumer health data sections do not create a private right of action.

Nevada and HIPAA

NRS 603A.490 lists what the consumer health data sections do not apply to. The first item is any person or entity that is subject to the Health Insurance Portability and Accountability Act of 1996 and its regulations. The list also excludes, among others, information used only for public health activities described in 45 CFR 164.512(b), patient identifying information handled under 42 CFR Part 2, and information governed by FERPA or the Fair Credit Reporting Act.

That wording is broader than Washington’s, which exempts protected health information rather than the business. A HIPAA covered practice should still confirm with counsel how the Nevada exemption applies to it and to each vendor it uses, because an ad platform, an analytics provider or a lead form tool is not necessarily subject to HIPAA itself. A health business that is not a HIPAA covered entity or business associate has no such exemption to rely on. The definitions of covered entity and business associate are in 45 CFR 160.103.

Connecticut: consumer health data in the CTDPA

Connecticut’s Data Privacy Act is codified at sections 42-515 to 42-526 of the Connecticut General Statutes. Public Act 23-56 added consumer health data provisions, including section 42-526, and the history note on that section shows Public Act 23-204 moved its effective date to October 1, 2023. Public Act 25-113 then amended several CTDPA sections effective July 1, 2026, and the General Assembly publishes those amended versions in its 2026 Supplement.

What counts as consumer health data. Section 42-515 defines consumer health data as any personal data that a controller uses to identify a consumer’s physical or mental health condition or diagnosis, and as amended effective July 1, 2026, condition, diagnosis or status. It includes gender-affirming health data and reproductive or sexual health data. A consumer health data controller is any controller that, alone or jointly with others, determines the purpose and means of processing consumer health data. Consumer health data is also listed as a category of sensitive data.

Rules that apply to any person, whatever its size. The general CTDPA duties apply to businesses that meet thresholds in section 42-516. Section 42-526 is different. Its subsection (a)(2) says the consumer health data provisions apply to persons that conduct business in Connecticut and persons that produce products or services targeted to residents of Connecticut, notwithstanding those thresholds. Under section 42-526(a)(1), no person shall:

provide any employee or contractor with access to consumer health data unless the employee or contractor is subject to a contractual or statutory duty of confidentiality;
provide any processor with access to consumer health data unless the person and processor comply with section 42-521, the section on processor duties and controller and processor contracts;
use a geofence to establish a virtual boundary within 1,750 feet of any mental health facility or reproductive or sexual health facility for the purpose of identifying, tracking, collecting data from or sending any notification to a consumer regarding the consumer’s consumer health data;
sell, or offer to sell, consumer health data without first obtaining the consumer’s consent.

Section 42-515 defines a mental health facility and a reproductive or sexual health facility by share of services: a health care facility where at least seventy per cent of the services are mental health services, or reproductive or sexual health care, respectively.

Consent means a clear affirmative act. Under section 42-520, a controller may not process sensitive data concerning a consumer without the consumer’s consent, and the version effective July 1, 2026 adds that the processing must also be reasonably necessary in relation to the purposes for which the sensitive data are processed. Section 42-515 defines consent as a clear affirmative act signifying freely given, specific, informed and unambiguous agreement, and says consent does not include acceptance of general or broad terms of use, hovering over, muting, pausing or closing content, or agreement obtained through dark patterns. A cookie banner that treats scrolling as agreement, or a privacy line buried in the terms of service, does not fit that definition.

Wider reach from July 1, 2026. As amended by Public Act 25-113, section 42-516 applies the general CTDPA provisions to persons that conduct business in Connecticut or target its residents and control or process the personal data of at least 35,000 consumers, and separately to persons that control or process consumers’ sensitive data, excluding data processed solely to complete a payment transaction, or that offer personal data for sale. A health business that processes consumer health data of Connecticut residents should therefore look at the full act, including privacy notices, consumer rights and data protection assessments, not only section 42-526.

Enforcement. Section 42-525 gives the Attorney General exclusive authority to enforce the act, treats a violation as an unfair trade practice, and says the act does not provide the basis for a private right of action.

Connecticut and HIPAA

Section 42-526(b) lists who the consumer health data rules in subsection (a) do not apply to. The list includes a covered entity or business associate, as defined in 45 CFR 160.103, along with state agencies and their contractors acting under contract, institutions of higher education, and certain financial institutions. Section 42-517 also exempts covered entities and business associates from the general act, in its version effective July 1, 2026 as well. As with Nevada, that leaves non-covered health businesses fully inside the law, and it leaves each vendor’s status as a question to answer on its own facts.

How Nevada and Connecticut differ from Washington

All three laws define health data broadly, reach businesses outside the state that target its residents, restrict geofencing at a 1,750 foot radius, and treat selling health data more strictly than other uses. The differences matter for planning:

Private lawsuits. Nevada’s NRS 603A.550 and Connecticut’s section 42-525 both say there is no private right of action. Washington’s RCW 19.373.090 applies its consumer protection act, and the Washington Attorney General’s FAQ says the law is enforced by the Attorney General and through private lawsuits.
HIPAA exemption. Nevada exempts any person or entity subject to HIPAA, and Connecticut exempts covered entities and business associates. Washington exempts protected health information, so a covered practice can still have Washington duties for data that is not protected health information.
Geofencing. Nevada’s ban covers areas around any medical facility or provider of in-person health care services or products. Connecticut’s covers areas around mental health facilities and reproductive or sexual health facilities as it defines them.
Separate consent to share. Nevada, like Washington, requires consent to share that is separate and distinct from consent to collect. Connecticut requires consent to process sensitive data and defines what consent is.

Other states: check where you have patients and audiences

Other states may have laws on consumer health data, or general privacy laws with rules for sensitive data, and these laws are amended: Connecticut’s was amended again effective July 1, 2026. This guide does not claim to list every state. For each state where you see patients, offer telehealth, ship products or run ads, ask counsel whether a consumer health data law or a general privacy law with sensitive data rules applies, what its HIPAA exemption covers, and when it takes effect. Recheck when you add a new state to an ad campaign or a telehealth license. For how the general privacy laws in California, Virginia, Texas and Colorado treat HIPAA covered entities, see our guide to state privacy laws and the HIPAA exemption.

Illustration: two health businesses, two answers

Illustration: a cash-pay wellness studio in another state runs online ads and ships at-home kits to customers in Nevada and Connecticut. It does not bill insurance and is not a HIPAA covered entity. Its website has an ad pixel on each service page and a quiz that asks about symptoms. Under the Nevada and Connecticut texts above, the studio looks like a regulated entity and a consumer health data controller. Its attorney would look at consent before the pixel and quiz collect data, a separate consent before sharing with the ad platform, a consumer health data privacy policy linked from the homepage, a request process, processor contracts with its vendors, and an instruction to its ad agency not to use location targeting around care sites.

Illustration: a dermatology practice that bills insurance electronically and is a HIPAA covered entity advertises to patients across a state line into Nevada. Its attorney would start from the HIPAA exemption in NRS 603A.490, then look at each vendor that touches visitor data and whether that vendor is itself subject to HIPAA, while the practice’s HIPAA obligations for patient information stay in place.

Checklist

List every state where you see patients, offer telehealth, ship products or target ads.
Confirm with counsel whether your business is a HIPAA covered entity or business associate, and what each state’s exemption covers for you and for each vendor.
Map what your website, forms, quizzes, chat tools and ad pixels collect, and which of it can identify or infer a health condition, status, procedure or medication.
Ask for consent before collecting consumer health data that is not needed to provide what the person asked for, and get a separate consent before sharing it where Nevada’s law applies.
Make consent a clear affirmative act: no pre-checked boxes, no scrolling as agreement, no consent buried in terms of use.
Publish a consumer health data privacy policy where required and link it conspicuously from the main website.
Set up a secure way for consumers to make requests to confirm, list recipients, stop and delete.
Put confidentiality duties in place for employees and contractors with access, and processor contracts with vendors.
Tell every ad vendor in writing not to geofence around care sites, and check that campaign settings match.
Do not sell consumer health data. If anyone proposes it, stop and get legal review of the authorization or consent requirements first.
Put a recheck date on your calendar, because these statutes are amended.

State breach notification laws are a separate set of rules from these privacy laws. Our guide to state data breach laws vs HIPAA covers deadlines and attorney general notices.

How we help

We build websites, local search, Google Ads and AI front desk tools for independent practices and health businesses. For a business that serves residents of more than one state, we can build a website with consent prompts that run before tags fire, forms that ask only for what is needed, and a clear link to the privacy policy your attorney approves, and we can set up ad campaigns without location targeting around care sites. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We do not sell lead lists and we do not pay for referrals. For the wider rules, see our healthcare marketing rules hub.

Does Nevada’s consumer health data law apply to a business outside Nevada?

It can. NRS 603A.465 defines a regulated entity as a person who conducts business in Nevada or produces or provides products or services targeted to consumers in Nevada, and who determines the purpose and means of processing, sharing or selling consumer health data. Location of the business is not the test.

Is a HIPAA covered practice exempt in Nevada and Connecticut?

The statutes give exemptions. NRS 603A.490 says the Nevada consumer health data sections do not apply to any person or entity subject to HIPAA, and Connecticut’s section 42-526(b) excludes covered entities and business associates as defined in 45 CFR 160.103. Vendors that are not themselves subject to HIPAA need their own review, so confirm the details with counsel.

Can consumers sue under these laws?

Not directly under these statutes. NRS 603A.550 says the Nevada consumer health data sections do not create a private right of action, and Connecticut’s section 42-525 gives its Attorney General exclusive enforcement authority and says the act does not provide the basis for a private right of action.

Can we run location-targeted ads near clinics?

Both states restrict it. NRS 603A.540 bars geofences within 1,750 feet of medical facilities and other providers of in-person health care for tracking consumers, collecting consumer health data or sending related ads. Connecticut’s section 42-526 bars geofences within 1,750 feet of mental health facilities and reproductive or sexual health facilities for similar purposes.

Does a cookie banner count as consent in Connecticut?

Only if it gets a clear affirmative act. Section 42-515 says consent does not include acceptance of general or broad terms of use, hovering over, muting, pausing or closing content, or agreement obtained through dark patterns.

Are Nevada, Connecticut and Washington the only states with these laws?

Do not assume so. Other states may have laws on consumer health data or on sensitive data that includes health information, and these laws are amended. This guide does not list every state, so check each state where you have patients, customers or ad audiences.

Consumer health data privacy laws beyond Washington: Nevada, Connecticut and what to check