Go to Previous Versions of this Statute
  1. 2023 Nevada Rev. Stat. (here)
  2. 2022 Nevada Rev. Stat.
  3. 2021 Nevada Rev. Stat.
  4. View All Versions

2023 Nevada Revised Statutes
Chapter 603A - Security and Privacy of Personal Information
NRS 603A.495 - Regulated entity required to develop and maintain policy concerning privacy of consumer health data; policy to be posted on Internet website maintained by regulated entity; prohibited acts. [Effective March 31, 2024.]

Universal Citation:
NV Rev Stat § 603A.495 (2023)
Learn more This media-neutral citation is based on the American Association of Law Libraries Universal Citation Guide and is not necessarily the official citation.
Previous Next

1. A regulated entity shall develop and maintain a policy concerning the privacy of consumer health data that clearly and conspicuously establishes:

(a) The categories of consumer health data being collected by the regulated entity and the manner in which the consumer health data will be used;

(b) The categories of sources from which consumer health data is collected;

(c) The categories of consumer health data that are shared by the regulated entity;

(d) The categories of third parties and affiliates with whom the regulated entity shares consumer health data;

(e) The purposes of collecting, using and sharing consumer health data;

(f) The manner in which consumer health data will be processed;

(g) The procedure for submitting a request pursuant to NRS 603A.505;

(h) The process, if any such process exists, for a consumer to review and request changes to any of his or her consumer health data that is collected by the regulated entity;

(i) The process by which the regulated entity notifies consumers whose consumer health data is collected by the regulated entity of material changes to the privacy policy;

(j) Whether a third party may collect consumer health data over time and across different Internet websites or online services when the consumer uses any Internet website or online service of the regulated entity; and

(k) The effective date of the privacy policy.

2. A regulated entity shall post conspicuously on the main Internet website maintained by the regulated entity a hyperlink to the policy developed pursuant to subsection 1 or otherwise provide that policy to consumers in a manner that is clear and conspicuous.

3. A regulated entity shall not:

(a) Collect, use or share categories of consumer health data, other than those included in the privacy policy pursuant to paragraph (c) of subsection 1, without disclosing those additional categories to each consumer whose data will be collected, used or shared and obtaining the affirmative, voluntary consent of the consumer;

(b) Share consumer health data with a third party or affiliate, other than those included in the privacy policy pursuant to paragraph (d) of subsection 1, without disclosing those additional third parties or affiliates to each consumer whose data will be shared and obtaining the affirmative, voluntary consent of the consumer;

(c) Collect, use or share consumer health data for purposes other than those included in the privacy policy pursuant to paragraph (e) of subsection 1 without disclosing those additional purposes to each consumer whose data will be collected, used or shared and obtaining the affirmative, voluntary consent of the consumer; or

(d) Enter into a contract pursuant to NRS 603A.530 with a processer to process consumer health data that is inconsistent with the privacy policy.

(Added to NRS by 2023, 3456, effective March 31, 2024)

Previous Next
Disclaimer: These codes may not be the most recent version. Nevada may have more current or accurate information. We make no warranties or guarantees about the accuracy, completeness, or adequacy of the information contained on this site or the information linked to on the state site. Please check official sources.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.