United States of America: Introduced Act Relative to Consumer Health Data (HD 3885)

On 20 January 2023, An Act Relative to Consumer Health Data (HD 3855) was introduced in the Massachusetts House of Representatives. The Act would apply to all entities that operate in Massachusetts or produce services or products for residents of Massachusetts while collecting, sharing or selling consumers' health data. The Act would exclude government authorities and those dealing with health data in a non-commercial context. The Act would require covered entities to establish and maintain a Consumer Health Data Privacy Policy (Policy), which should be published on its website. The Policy must include the types of Consumer Health Data collected, the sources of such data and how such data is used and shared. Consumer Health Data not specified in the Policy may only be collected or shared with the consumer’s consent. Consumers have the right to information about the collection practices of the entity, may opt out of the collection and sharing of their health data and also have the right to deletion. Covered entities are prohibited from discriminating against consumers that exercise the aforementioned rights and must delete the Consumer Health Data within 30 days at the consumer’s request.