Section 603A.NEW - [Newly enacted section not yet numbered] [Policy concerning privacy of consumer health data]1. A regulated entity shall develop and maintain a policy concerning the privacy of consumer health data that clearly and conspicuously establishes:(a) The categories of consumer health data being collected by the regulated entity and the manner in which the consumer health data will be used;(b) The categories of sources from which consumer health data is collected;(c) The categories of consumer health data that are shared by the regulated entity;(d) The categories of third parties and affiliates with whom the regulated entity shares consumer health data;(e) The purposes of collecting, using and sharing consumer health data;(f) The manner in which consumer health data will be processed;(g) The procedure for submitting a request pursuant to section 24 of this act;(h) The process, if any such process exists, for a consumer to review and request changes to any of his or her consumer health data that is collected by the regulated entity;(i) The process by which the regulated entity notifies consumers whose consumer health data is collected by the regulated entity of material changes to the privacy policy;(j) Whether a third party may collect consumer health data over time and across different Internet websites or online services when the consumer uses any Internet website or online service of the regulated entity; and(k) The effective date of the privacy policy.2. A regulated entity shall post conspicuously on the main Internet website maintained by the regulated entity a hyperlink to the policy developed pursuant to subsection 1 or otherwise provide that policy to consumers in a manner that is clear and conspicuous.3. A regulated entity shall not: (a) Collect, use or share categories of consumer health data, other than those included in the privacy policy pursuant to paragraph (c) of subsection 1, without disclosing those additional categories to each consumer whose data will be collected, used or shared and obtaining the affirmative, voluntary consent of the consumer;(b) Share consumer health data with a third party or affiliate, other than those included in the privacy policy pursuant to paragraph (d) of subsection 1, without disclosing those additional third parties or affiliates to each consumer whose data will be shared and obtaining the affirmative, voluntary consent of the consumer;(c) Collect, use or share consumer health data for purposes other than those included in the privacy policy pursuant to paragraph (e) of subsection 1 without disclosing those additional purposes to each consumer whose data will be collected, used or shared and obtaining the affirmative, voluntary consent of the consumer; or(d) Enter into a contract pursuant to section 29 of this act with a processer to process consumer health data that is inconsistent with the privacy policy.Added by 2023, Ch. 525,§21, eff. 3/31/2024.