Nevada SB 370 and consumer health data on your website

Who it applies to

A “regulated entity” is any person who:

• conducts business in Nevada, or produces or provides products or services targeted to Nevada consumers; and
• alone or with others, determines the purpose and means of processing, sharing or selling consumer health data (NRS 603A.465).

A “consumer” is a natural person who has requested a product or service from the regulated entity and who lives in Nevada, or whose consumer health data is collected in Nevada (NRS 603A.425). That wording is narrower than Washington's. How it applies to anonymous visitors browsing your marketing pages is a question for counsel.

What counts as consumer health data

It's personally identifiable information, linked or reasonably capable of being linked to a consumer, that a regulated entity uses to identify the consumer's past, present or future health status (NRS 603A.430). It includes information about:

• health conditions, diagnoses and interventions
• surgeries and procedures
• use or acquisition of medication
• bodily functions, vital signs and symptoms
• reproductive or sexual health care, and gender-affirming care
• related biometric or genetic data
• precise geolocation used to indicate an attempt to get health care
• any of the above derived or extrapolated from other data, including by algorithm or machine learning

It excludes information used to identify shopping habits or interests, as long as it isn't used to identify a specific health status, and certain video game data.

Consent before collecting and sharing

Under NRS 603A.500, a regulated entity may collect consumer health data only with the consumer's affirmative, voluntary consent, or to the extent necessary to provide a product or service the consumer requested. It may share the data only with affirmative, voluntary consent that is separate and distinct from the collection consent, to provide a requested product or service, or where another law requires or authorizes it.

Consent must be obtained before collection or sharing, and the request must clearly and conspicuously disclose:

1. the categories of data
2. the purpose of collecting or sharing it
3. if it will be shared, the categories of persons and entities it's shared with
4. how to withdraw consent

Other website-facing obligations

• Privacy policy. Maintain a consumer health data privacy policy with specific contents and post a conspicuous link to it on your main website (NRS 603A.495). Required contents include whether a third party may collect consumer health data over time and across different websites when someone uses your site (that's directly about third-party tracking) and the policy's effective date.
• Consumer requests (NRS 603A.505–.515): consumers can ask you to confirm collection, list the third parties you share with, stop collecting, sharing or selling, and delete their data. You respond within 45 days of authenticating the request, extendable once by 45 days, and complete deletion within 30 days of authenticating a deletion request, notifying the third parties you shared with.
• Sale requires a signed written authorization with set contents. It expires after one year, a copy goes to the purchaser, and both seller and purchaser keep a copy for at least six years after it expires (NRS 603A.535). A cookie banner is not that authorization.
• Non-discrimination. You may not discriminate against a consumer for exercising these rights (NRS 603A.545).
• Geofencing. Geofences within 1,750 feet of medical facilities and other in-person health care providers, used to track, collect data or send health-related messages, are prohibited (NRS 603A.540).

Exemptions and enforcement

The law does not apply to “any person or entity that is subject to” HIPAA, among other exemptions (NRS 603A.490). That's an entity-level exemption, unlike Washington's data-level one, so a company that is partly HIPAA-covered should have counsel confirm how it applies.

A violation is a deceptive trade practice, and the law does not create a private right of action (NRS 603A.550). In actions by the Attorney General and other listed officials, a court can award civil penalties of up to $15,000 per violation when it finds a willful deceptive trade practice (NRS 598.0999(2)).

Nevada, Washington and Connecticut at a glance

Details: Washington MHMDA guide · Connecticut and other regulations

How CookieGuard's Healthcare plan supports SB 370 consent

• Separate choices to collect and to share health data, never pre-checked. Sharing needs health data first, Accept All grants neither, and Reject All denies both.
• Ad tags wait for consent to share. With health-data mode on, marketing tags and Google's ad signals stay off until the visitor agrees to share health data.
• Nevada rules where they apply. Switch on SB 370 and visitors located in Nevada get an opt-in banner with these choices. You can extend the rules to all US visitors or everyone, and they also apply when a visitor's location can't be determined.
• Consent records for each decision, including whether SB 370 applied and whether health data and sharing were granted, exportable as CSV or JSON.

Related: Tracking pixels on telehealth and health websites