Section 603A.NEW - [Newly enacted section not yet numbered] [Processing consumer health data pursuant to contract]1. A processor shall only process consumer health data pursuant to a contract between the processor and a regulated entity. Such a contract must set forth the applicable processing instructions and the specific actions that the processor is authorized to take with regard to the consumer health data it possesses on behalf of the regulated entity.2. To the extent practicable, a processor shall assist the regulated entity with which the processor has entered into a contract pursuant to subsection 1 in complying with the provisions of sections 2 to 34, inclusive, of this act.3. If a processor processes consumer health data outside the scope of a contract described in subsection 1 or in a manner inconsistent with any provision of such a contract, the processor: (a) Is not guilty of a deceptive trade practice pursuant to section 34 of this act solely because the processor violated the requirements of this section; and(b) Shall be deemed a regulated entity for the purposes of sections 2 to 34, inclusive, of this act, for actions and omissions with regard to such consumer health data.Added by 2023, Ch. 525,§29, eff. 3/31/2024.