Section 603A.NEW - [Newly enacted section not yet numbered] [Collection of consumer health data]1. A regulated entity shall not collect consumer health data except:(a) With the affirmative, voluntary consent of the consumer; or(b) To the extent necessary to provide a product or service that the consumer to whom the consumer health data relates has requested from the regulated entity.2. A regulated entity shall not share consumer health data except:(a) With the affirmative, voluntary consent of the consumer to whom the consumer health data relates, which must be separate and distinct from the consent provided pursuant to subsection 1 for the collection of the data;(b) To the extent necessary to provide a product or service that the consumer to whom the consumer health data relates has requested from the regulated entity; or(c) Where required or authorized by another provision of law.3. Any consent required by this section must be obtained before the collection or sharing, as applicable, of consumer health data. The request for such consent must clearly and conspicuously disclose: (a) The categories of consumer health data to be collected or shared, as applicable;(b) The purpose for collecting or sharing, as applicable, the consumer health data including, without limitation, the manner in which the consumer health data will be used;(c) If the consumer health data will be shared, the categories of persons and entities with whom the consumer health data will be shared; and(d) The manner in which the consumer may withdraw consent for the collection or sharing, as applicable, of consumer health data relating to the consumer and request that the regulated entity cease such collection or sharing pursuant to section 24 of this act.Added by 2023, Ch. 525,§22, eff. 3/31/2024.