S4684

An Act concerning consumer health data and supplementing Title 56 of the Revised Statutes.

Be It Enacted by the Senate and General Assembly of the State of New Jersey:

1. As used in this act:

a. "Abortion" means the termination of a pregnancy for purposes other than producing a live birth.

b. "Affiliate" means a legal entity that shares common branding with another legal entity and controls, is controlled by, or is under common control with another legal entity. For the purposes of this definition, "control" or "controlled" shall mean:

(1) ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a company;

(2) control in any manner over the election of a majority of the directors or of individuals exercising similar functions; or

(3) the power to exercise controlling influence over the management of a company.

c. "Authenticate" means to use reasonable means to determine that a request to exercise any of the rights afforded in this act is being made by, or on behalf of, the consumer who is entitled to exercise such consumer rights with respect to the consumer health data at issue.

d. "Biometric data" means data that is generated from the measurement or technological processing of an individual's physiological, biological, or behavioral characteristics and that identifies a consumer, whether individually or in combination with other data. Biometric data shall include, but shall not be limited to: imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template can be extracted; or keystroke patterns or rhythms and gait patterns or rhythms that contain identifying information.

e. "Collect" means to buy, rent, access, retain, receive, acquire, infer, derive, or otherwise process consumer health data in any manner.

f. "Consent" means a clear affirmative act that signifies a consumer's freely given, specific, informed, opt-in, voluntary, and unambiguous agreement, which may include written consent provided by electronic means. "Consent" may not be obtained by:

(1) a consumer's acceptance of a general or broad terms of use agreement or a similar document that contains descriptions of personal data processing along with other unrelated information;

(2) a consumer hovering over, muting, pausing, or closing a given piece of content; or

(3) a consumer's agreement obtained through the use of deceptive designs.

g. "Consumer" means: a natural person who is a New Jersey resident; a natural person whose consumer health data is collected in New Jersey; or a natural person who acts only in an individual or household context, however identified, including by any unique identifier. "Consumer" shall not include an individual acting in an employment context.

h. "Consumer health data" or “data” means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status including, but not limited to:

(1) individual health conditions, treatment, diseases, diagnotstic testing, or diagnosis, and social, psychological, behavioral, and medical interventions;

(2) health-related surgeries or procedures;

(3) use or purchase of prescribed medication;

(4) bodily functions, vital signs, symptoms, or measurements of the consumer’s health;

(5) reproductive or sexual health information;

(6) biometric data;

(7) genetic data;

(8) precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies;

(9) data that identifies a consumer seeking health care services; or

(10) any information that a regulated entity, or their respective processor, processes to associate or identify a consumer with consumer health data that is derived or extrapolated from non-health information such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning.

"Consumer health data" shall not include personal information that is used to engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board, human subjects research ethics review board, or a similar independent oversight entity that determines that the regulated entity has implemented reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with reidentification.

i. "Deceptive design" means a user interface designed or manipulated with the effect of subverting or impairing user autonomy, decision making, or choice.

j. “Deidentified data" means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable consumer, or a device linked to such consumer.

k. "Genetic data" means any data, regardless of its format, that concerns a consumer's genetic characteristics. "Genetic data" shall include, but shall not be limited to: raw sequence data that result from the sequencing of a consumer's complete extracted deoxyribonucleic acid (DNA) or a portion of the extracted DNA; genotypic and phenotypic information that results from analyzing the raw sequence data; and self-reported health data that a consumer submits to a regulated entity and that is analyzed in connection with consumer's raw sequence data.

l. "Geofence" means technology that uses global positioning coordinates, cell tower connectivity, cellular data, radio frequency identification, Wifi data, or any other form of spatial or location detection to establish a virtual boundary around a specific physical location, or to locate a consumer within a virtual boundary. For purposes of this definition, "geofence" shall mean a virtual boundary that is 2,000 feet or less from the perimeter of the physical location.

m. "Health care services" means any service provided to a person to assess, measure, improve, or learn about a person's mental or physical health, including but not limited to: individual health conditions, status, diseases, or diagnoses; social, psychological, behavioral, and medical interventions; health-related surgeries or procedures; use or purchase of medication; bodily functions, vital signs, symptoms, or measurements of the person’s health; diagnoses or diagnostic testing, treatment, or medication; or reproductive health services.

n. "Homepage" means the introductory page of an Internet website and any Internet webpage where personal information is collected. In the case of an online service, such as a mobile application, homepage means the application's platform page or download page, and a link within the application, such as from the application configuration, "about," "information," or settings page.

p. "Person" means, where applicable, natural persons, corporations, trusts, unincorporated associations, and partnerships. "Person" shall not include government agencies, tribal nations, or contracted service providers when processing consumer health data on behalf of a government agency.

q. "Personal information" means information that identifies or is reasonably capable of being associated or linked, directly or indirectly, with a particular consumer. "Personal information" shall includes, but not be limited to, data associated with a persistent unique identifier, such as a cookie ID, an IP address, a device identifier, or any other form of persistent unique identifier. "Personal information" shall not include publicly available information or deidentified data.

r. "Precise location information" means information derived from technology including, but not limited to, global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet. "Precise location information" shall not include the content of communications, or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.

s. "Process" or "processing" means any operation or set of operations performed on consumer health data.

t. "Processor" means a person that processes consumer health data on behalf of a regulated entity.

u. "Publicly available information" means information that is lawfully made available through federal, State, or municipal government records or widely distributed media, and a regulated entity has a reasonable basis to believe a consumer has lawfully made available to the general public. "Publicly available information" shall not include any biometric data collected about a consumer by a business without the consumer's consent.

v. "Regulated entity" means any legal entity that: conducts business in New Jersey, or produces or provides products or services that are targeted to consumers in New Jersey; and alone or jointly with others, determines the purpose and means of collecting, processing, sharing, or selling of consumer health data. "Regulated entity" shall not mean government agencies, tribal nations, or contracted service providers when processing consumer health data on behalf of the government agency.

w. "Reproductive or sexual health information" means personal information relating to seeking or obtaining past, present, or future reproductive or sexual health services. "Reproductive or sexual health information" shall include, but be not limited to:

(1) precise location information that could reasonably indicate a consumer's attempt to acquire or receive reproductive or sexual health services;

(2) efforts to research or obtain reproductive or sexual health services; or

(3) any reproductive or sexual health information that is derived, extrapolated, or inferred, including from non-health information such as proxy, derivative, inferred, emergent, or algorithmic data.

x. "Reproductive or sexual health services" means health services or products that support or relate to a consumer's reproductive system or sexual well-being, including but not limited to:

(1) individual health conditions, status, diseases, diagnostic testin, or diagnoses;

(2) social, psychological, behavioral, and medical interventions;

(3) health-related surgeries or procedures including, but not limited to, abortions;

(4) use or purchase of medication including, but not limited to, medications for the purposes of abortion;

(5) bodily functions, vital signs, symptoms, or measurements of the consumer’s health; and

(6) medical or nonmedical services related to and provided in conjunction with an abortion, including but not limited to associated diagnostics, counseling, supplies, and follow-up services.

y. "Sell" or "sale" means the exchange of consumer health data for monetary or other valuable consideration. "Sell" or "sale" shall not include the exchange of consumer health data for monetary or other valuable consideration: to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the regulated entity's assets that complies with the requirements and obligations in this chapter; or by a regulated entity to a processor when such exchange is consistent with the purpose for which the consumer health data was collected and disclosed to the consumer.

z. "Share" or "sharing" means to release, disclose, disseminate, divulge, make available, provide access to, license, or otherwise communicate orally, in writing, or by electronic or other means, consumer health data by a regulated entity to a third party or affiliate. The term "share" or "sharing" shall not include:

(1) the disclosure of consumer health data by a regulated entity to a processor when such sharing is to provide goods or services in a manner consistent with the purpose for which the consumer health data was collected and disclosed to the consumer;

(2) the disclosure of consumer health data to a third party with whom the consumer has a direct relationship when:

(a) the disclosure is for purposes of providing a product or service requested by the consumer;

(b) the regulated entity maintains control and ownership of the data; and

(c) the third party uses the consumer health data only at direction from the regulated entity and consistent with the purpose for which it was collected and consented to by the consumer; or

(d) the disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the regulated entity's assets and complies with the requirements and obligations in this chapter.

aa. "Third party" means an entity other than a consumer, regulated entity, processor, or affiliate of the regulated entity.

2. a. A regulated entity shall maintain a consumer health data privacy policy that clearly and conspicuously discloses:

(1) the categories of consumer health data collected and the purpose for which the data is collected, including how the data will be used;

(2) the categories of sources from which the consumer health data is collected;

(3) the categories of consumer health data that is shared;

(4) a list of the categories of third parties and specific affiliates with whom the regulated entity shares the consumer health data; and

(5) how a consumer can exercise any rights provided pursuant to section 4 of this act.

b. A regulated entity shall prominently publish a link to its consumer health data privacy policy on its Internet website.

c. A regulated entity may not collect, use, or share additional categories of consumer health data not disclosed in the consumer health data privacy policy without first disclosing the additional categories and obtaining the consumer's affirmative consent prior to the collection, use, or sharing of such consumer health data.

d. A regulated entity may not collect, use, or share consumer health data for additional purposes not disclosed in the consumer health data privacy policy without first disclosing the additional purposes and obtaining the consumer's affirmative consent prior to the collection, use, or sharing of such consumer health data.

e. It shall be a violation of this act for a regulated entity to contract with a processor to process consumer health data in a manner that is inconsistent with the regulated entity's consumer health data privacy policy.

3. a. A regulated entity shall not collect any consumer health data except:

(1) with consent from the consumer for such collection for a specified purpose; or

(2) to the extent necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity.

b. A regulated entity may not share any consumer health data except:

(1) with consent from the consumer for such sharing that is separate and distinct from the consent obtained to collect consumer health data; or

(2) to the extent necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity.

c. Consent required under this section shall be obtained prior to the collection or sharing, as applicable, of any consumer health data, and the request for consent shall clearly and conspicuously disclose:

(1) the categories of consumer health data collected or shared;

(2) the purpose of the collection or sharing of the consumer health data, including the specific ways in which it will be used;

(3) the categories of entities with whom the consumer health data is shared; and

(4) how the consumer can withdraw consent from future collection or sharing of the consumer's health data.

d. A regulated entity shall not unlawfully discriminate against a consumer for exercising any rights included section 4 of this act.

4. a. A consumer shall have the right to:

(1) confirm whether a regulated entity is collecting, sharing, or selling consumer health data concerning the consumer and to access such data, including a list of all third parties and affiliates with whom the regulated entity has shared or sold the consumer health data and an active email address or other online mechanism that the consumer may use to contact these third parties;

(2) withdraw consent from the regulated entity's collection and sharing of consumer health data concerning the consumer; and

(3) have consumer health data concerning the consumer deleted and may exercise that right by informing the regulated entity of the consumer's request for deletion.

b. (1) A regulated entity that receives a consumer's request to delete any consumer health data concerning the consumer shall:

(a) delete the consumer health data from its records, including from all parts of the regulated entity's network, including archived or backup systems pursuant to paragraph (3) of this subsection; and

(b) notify all affiliates, processors, contractors, and other third parties with whom the regulated entity has shared consumer health data of the deletion request.

(2) All affiliates, processors, contractors, and other third parties that receive notice of a consumer's deletion request pursuant to this subsection shall honor the consumer's deletion request and delete the consumer health data from its records.

(3) If consumer health data that a consumer requests to be deleted is stored on archived or backup systems, then the request for deletion may be delayed to enable restoration of the archived or backup systems and such delay may not exceed six months from authenticating the deletion request.

c. A consumer may exercise the rights set forth in subsection a. of this section by submitting a request, at any time, to a regulated entity. Such a request may be made by a secure and reliable means established by the regulated entity and described in its consumer health data privacy policy pursuant to section 2 of this act. The method shall take into account the ways in which consumers normally interact with the regulated entity, the need for secure and reliable communication of such requests, and the ability of the regulated entity to authenticate the identity of the consumer making the request. A regulated entity may not require a consumer to create a new account in order to exercise consumer rights pursuant to this section, but may require a consumer to use an existing account.

d. If a regulated entity is unable to authenticate a request using commercially reasonable efforts, the regulated entity shall not be required to comply with a request to initiate an action under this section and may request that the consumer provide additional information reasonably necessary to authenticate the consumer and the consumer's request.

e. Information provided in response to a consumer request shall be provided by a regulated entity free of charge, up to twice annually per consumer. If requests from a consumer are manifestly unfounded, excessive, or repetitive, the regulated entity may charge the consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request. The regulated entity shall bear the burden of demonstrating the manifestly unfounded, excessive, or repetitive nature of the request.

f. A regulated entity shall comply with a consumer's request within 45 days of receipt of the request submitted pursuant to the methods described in this section. The response period may be extended once by 45 additional days when reasonably necessary, taking into account the complexity and number of the consumer's requests, so long as the regulated entity informs the consumer of any such extension within the initial 45-day response period, together with the reason for the extension.

g. A regulated entity shall establish a process for a consumer to appeal the regulated entity's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decision. The appeal process shall be conspicuously available and similar to the process for submitting requests to initiate action pursuant to this section. Within 45 days of receipt of an appeal, a regulated entity shall inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, the regulated entity shall also provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the Attorney General to submit a complaint.

5. A regulated entity shall:

a. restrict access to consumer health data by the employees, processors, and contractors of such regulated entity to only those employees, processors, and contractors for which access is necessary to further the purposes for which the consumer provided consent or where necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity; and

b. establish, implement, and maintain administrative, technical, and physical data security practices that, at a minimum, satisfy reasonable standard of care within the regulated entity's industry to protect the confidentiality, integrity, and accessibility of consumer health data appropriate to the volume and nature of the consumer health data at issue.

6. a. A processor may process consumer health data only pursuant to a binding contract between the processor and the regulated entity that sets forth the processing instructions and limits the actions the processor may take with respect to the consumer health data it processes on behalf of the regulated entity.

b. A processor may process consumer health data only in a manner that is consistent with the binding instructions set forth in the contract with the regulated entity.

c. To the extent possible, a processor shall assist the regulated entity by appropriate technical and organizational measures in fulfilling the regulated entity's obligations under this act.

d. If a processor fails to adhere to the regulated entity's instructions or processes consumer health data in a manner that is outside the scope of the processor's contract with the regulated entity, the processor shall be considered a regulated entity with regard to such data and shall be subject to all the requirements of this act with regard to such data.

7. a. It shall be unlawful for any person to sell or offer to sell consumer health data concerning a consumer without first obtaining valid authorization from the consumer. The sale of consumer health data shall be consistent with the valid authorization signed by the consumer, which authorization shall be separate and distinct from the any consent obtained to collect or share consumer health data.

b. A valid authorization to sell consumer health data shall be written in plain language and shall contain the following:

(1) the specific consumer health data concerning the consumer that the person intends to sell;

(2) the name and contact information of the person collecting and selling the consumer health data;

(3) the name and contact information of the person purchasing the consumer health data from the seller identified in paragraph (2) of this subsection;

(4) a description of the purpose for the sale, including how the consumer health data will be gathered and how it will be used by the purchaser identified in paragraph (3) of this subsection when sold;

(5) a statement that the provision of goods or services may not be conditioned on the consumer signing the valid authorization;

(6) a statement that the consumer has a right to revoke the valid authorization at any time and a description on how to submit a revocation of the valid authorization;

(7) a statement that the consumer health data sold pursuant to the valid authorization may be subject to redisclosure by the purchaser and may no longer be protected by this section;

(8) an expiration date for the valid authorization that expires one year from when the consumer signs the valid authorization; and

(9) the signature of the consumer and date.

c. An authorization shall not be valid if the document has any of the following defects:

(1) the expiration date has passed;

(2) the authorization does not contain all the information required under this section;

(3) the authorization has been revoked by the consumer;

(4) the authorization has been combined with other documents to create a compound authorization; or

(5) the provision of goods or services is conditioned on the consumer signing the authorization.

d. A copy of the signed valid authorization shall be provided to the consumer.

e. The seller and purchaser of consumer health data shall retain a copy of each valid authorization for sale of consumer health data for six years from the date of its signature or the date when it was last in effect, whichever is later.

8. It shall be unlawful for any person to implement a geofence around an entity that provides in-person health care services where such geofence would be used to: identify or track consumers seeking health care services; collect consumer health data from consumers; or send notifications, messages, or advertisements to consumers related to their consumer health data or health care services.

9. A violation of this act shall be considered an unlawful practice in violation of P.L.1960, c.39 (C.56:8-1 et seq.).

10. a. The provisions of this act shall not apply to any:

(1) body, authority, board, bureau, commission, district or agency of this State or of any political subdivision of this State;

(2) nonprofit organization;

(3) institution of higher education;

(4) national securities association that is registered under 15 U.S.C s.78o-3 of the federal Securities Exchange Act of 1934, as amended from time to time;

(5) financial institution or data subject to Title V of the federal Gramm-Leach-Bliley Act, 15 U.S.C s.6801 et seq.; or

(6) covered entity or business associate, as defined in 45 C.F.R. s.160.103.

b. The following information and data shall be exempt from the provisions of this act:

(1) protected health information under the federal Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191;

(2) patient-identifying information for purposes of 42 U.S.C s.290dd-2;

(3) identifiable private information for purposes of the federal policy for the protection of human subjects under 45 C.F.R Part 46;

(4) identifiable private information that is otherwise information collected as part of human subjects research pursuant to the Good Clinical Practice Guidelines issued by the International Council for Harmonization of Technical Requirements for Pharmaceuticals for Human Use;

(5) the protection of human subjects under 21 C.F.R. Parts 6, 50, and 56, or personal data used or shared in research, as defined in 45 C.F.R. s.164.501 that is conducted in accordance with the standards set forth under federal law, or other research conducted in accordance with applicable law;

(6) information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986, 42 U.S.C. s.11101 et seq.;

(7) patient safety work product for the purposes of federal Patient Safety and Quality Improvement Act, 42 U.S.C. s.299b-21 et seq., as

amended from time to time;

(8) information derived from any of the health care related information listed in paragraph (3) of this subsection that is deidentified in accordance with the requirements for de-identification pursuant to the federal Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191;

(9) information originating from and intermingled to be indistinguishable with, or information treated in the same manner as, information exempt under this subsection that is maintained by a covered entity or business associate, program or qualified service organization, as specified in 42 U.S.C. s.290dd-2, as amended from time to time;

(10) information used for public health activities and purposes as authorized by the federal Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, community health activities and population

health activities;

(11) the collection, maintenance, disclosure, sale, communication or use of any personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living by a consumer reporting agency, furnisher or user that provides information for use in a consumer report, and by a user of a consumer report, but only to the extent that such activity is regulated by and authorized under the federal Fair Credit Reporting Act, 15 U.S.C. s.1681 et seq., as amended from time to time;

(12) personal data collected, processed, sold or disclosed in compliance with the federal Driver's Privacy Protection Act of 1994, 18 U.S.C. s.2721 et seq., as amended from time to time;

(13) personal data regulated by the federal Family Educational Rights and Privacy Act, 20 U.S.C. s.1232g et seq., as amended from time to time;

(14) personal data collected, processed, sold or disclosed in compliance with the federal Farm Credit Act, 12 U.S.C. s.2001 et seq., as amended from time to time;

(15) data processed or maintained:

(a) in the course of an individual applying to, employed by or acting as an agent or independent contractor of a regulated entity, processor, or third party, to the extent that the data is collected and used within the context of that role;

(b) as the emergency contact information of a consumer used for

emergency contact purposes; or

(c) that is necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information under paragraph (1) of this subsection and used for the purposes of administering such benefits; and

(16) personal data collected, processed, sold or disclosed in relation to price, route or service, as such terms are used in the federal Airline Deregulation Act, 49 U.S.C. s.40101 et seq., as amended from time to time, by an air carrier, to the extent that the provisions of this act are preempted by the federal Airline Deregulation Act, 49 U.S.C. s.41713, as amended from time to time.

11. a. Nothing in this act shall be construed to restrict a regulated entity's or processor's ability for the collection, use, or disclosure of consumer health data to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any activity that is illegal under State law or federal law; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action that is illegal under State law or federal law.

b. If a regulated entity or processor processes consumer health data pursuant to subsection a. of this section, such entity shall bear the burden of demonstrating that such processing qualifies for the exemption provided under this section.

12. The Director of the Division of Consumer Affairs in the Department of Law and Public Safety shall adopt rules and regulations, pursuant to the “Administrative Procedure Act,” P.L.1968, c.410 (C.52:14B-1 et seq.), as shall be necessary for the implementation of P.L. , c. (C. ) (pending before the Legislature as this bill).

13. This act shall take effect immediately.

STATEMENT

This bill establishes certain data privacy protection requirements for consumer health data, health care providers, and patients.

The bill defines a "regulated entity" to mean any legal entity that: conducts business in New Jersey, or produces or provides products or services that are targeted to consumers in New Jersey; and alone or jointly with others, determines the purpose and means of collecting, processing, sharing, or selling of consumer health data. "Regulated entity" does not mean a government agency, tribal nation, or contracted service provider when processing consumer health data on behalf of the government agency.

Under the bill, each regulated entity in the State is to maintain a consumer health data privacy policy that details how data may be collected and shared and how consumer can exercise their rights provided by the bill concerning consumer health data. “Consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.

The bill establishes certain requirements for regulated entities to collect, share, and sell consumer health data, which includes requiring consumers to provide consent or authorization in order for a regulated entity to collect, share, or sell any consumer health data. Under the bill, consumers will have certain rights concerning their consumer health data, including: confirming which data is being collected, shared, or sold; withdrawing consent for the collection, sharing, or sale of the data; or requesting the deletion of the data. The bill establishes certain requirements for regulated entities to process any requests for the deletion of a consumer’s consumer health data.

The bill requires a regulated entity to restrict access to consumer health data as necessary and to establish certain data security practice to protect consumer health data.

The bill provides that a processer may process consumer health data only pursuant to a binding contract between the processor and the regulated entity that sets forth the processing instructions and limits the actions the processor may take with respect to the consumer health data it processes on behalf of the regulated entity.

The bill prohibits any person from implementing a geofence around an entity that provides in-person health care services where such geofence would be used to: identify or track consumers seeking health care services; collect consumer health data from consumers; or send notifications, messages, or advertisements to consumers related to their consumer health data or health care services.

The bill provides that any violation of bill’s provisions will be considered an unlawful practice in violation of P.L.1960, c.39 (C.56:8-1 et seq.)

The bill outlines certain entities and types of information and data that are exempted from the provisions of the bill.

The bill provides that nothing in the bill’s provisions is to construed to restrict a regulated entity's or processor's ability for the collection, use, or disclosure of consumer health data to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any activity that is illegal under State law or federal law; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action that is illegal under State law or federal law, except that such entity bears the burden of demonstrating that such processing qualifies for the exemption provided under the bill.