Senate Bill No. 370 for An Act relating to data privacy was approved, on June 15, 2023, by the Nevada Governor, thereby becoming law. In summary, the Act prescribes various protections for consumer health data that is maintained and used by other persons or non-governmental entities, among other purposes.

Scope and definitions

The Act imposes obligations and prohibitions on regulated entities, whereby a regulated entity is defined as a person who:

• conducts business in Nevada or produces or provides products or services that are targeted to consumers in Nevada; and
• determines the purpose and means of processing, sharing, or selling consumer health data. 

In turn, the term 'consumer health data' is used within the Act to refer to personally identifiable information that is linked or reasonably capable of being linked to a consumer and is used by a regulated entity to identify the health status of the consumer.

Obligations

The Act lays down requirements in relation to consumer health data privacy policies, consumer health data rights, security practices, and data processor requirements. The Act generally prohibits a regulated entity from collecting or sharing consumer health data without the affirmative and voluntary consent of the consumer to whom the data relates. Notably, the law stipulates that the consumer's consent to share must be separate and distinct from the consent provided for the collection of their health data. 

Enforcement

The Act does not create a private right of action. Instead, violations of the Act constitute a deceptive trade practice under Nevada law.

The Act will become effective on March 31, 2024.

You can read the Act here and view its history here.