Section 603A.NEW - [Newly enacted section not yet numbered] [Deletion request]1. Not later than 30 days after authenticating a request made pursuant to paragraph (d) of subsection 1 of section 24 of this act for the deletion of consumer health data, a regulated entity shall, except as otherwise provided in subsection 3: (a) Delete all consumer health data described in the request from the records and network of the regulated entity; and(b) Notify each affiliate, processor, contractor or other third party with which the regulated entity has shared consumer health data of the deletion request.2. Not later than 30 days after receiving notification of a deletion request pursuant to paragraph (b) of subsection 1, an affiliate, processor, contractor or other third party shall, except as otherwise provided in subsection 3, delete the consumer health data described in the request from the records and network of the affiliate, processor, contractor or other third party.3. If data described in a deletion request made pursuant to paragraph (d) of subsection 1 of section 24 of this act is stored or archived on backup systems, a regulated entity or an affiliate, processor, contractor or other third party may delay the deletion of the data for not more than 2 years after the request is authenticated, as necessary to restore the archived or backup system.Added by 2023, Ch. 525,§26, eff. 3/31/2024.