2023 Nevada Revised Statutes
Chapter 603A - Security and Privacy of Personal Information
NRS 603A.500 - Collection and sharing of consumer health data by regulated entity prohibited; exceptions; required disclosures for request for consent to collect or share consumer health data. [Effective March 31, 2024.]

1. A regulated entity shall not collect consumer health data except:

(a) With the affirmative, voluntary consent of the consumer; or

(b) To the extent necessary to provide a product or service that the consumer to whom the consumer health data relates has requested from the regulated entity.

2. A regulated entity shall not share consumer health data except:

(a) With the affirmative, voluntary consent of the consumer to whom the consumer health data relates, which must be separate and distinct from the consent provided pursuant to subsection 1 for the collection of the data;

(b) To the extent necessary to provide a product or service that the consumer to whom the consumer health data relates has requested from the regulated entity; or

(c) Where required or authorized by another provision of law.

3. Any consent required by this section must be obtained before the collection or sharing, as applicable, of consumer health data. The request for such consent must clearly and conspicuously disclose:

(a) The categories of consumer health data to be collected or shared, as applicable;

(b) The purpose for collecting or sharing, as applicable, the consumer health data including, without limitation, the manner in which the consumer health data will be used;

(c) If the consumer health data will be shared, the categories of persons and entities with whom the consumer health data will be shared; and

(d) The manner in which the consumer may withdraw consent for the collection or sharing, as applicable, of consumer health data relating to the consumer and request that the regulated entity cease such collection or sharing pursuant to NRS 603A.505.

(Added to NRS by 2023, 3457, effective March 31, 2024)