Nevada § 603A.490 - Applicability

§ 603A.490. Applicability

1. The provisions of NRS 603A.400 to 603A.550 , inclusive, do not apply to: (a) Any person or entity that is subject to the Health Insurance Portability and Accountability

Act of 1996, Public Law 104-191 , and the regulations adopted pursuant thereto. (b) A financial institution or an affiliate of a financial institution that is subject

to the provisions of the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801 et seq., or any personally identifiable information regulated by that Act which is collected,

maintained or sold as provided in that Act. (c) Patient identifying information, as defined in 42 C.F.R. § 2.11 , that is collected, used or disclosed in accordance with 42 C.F.R. Part 2 . (d) Patient safety work product, as defined in 42 C.F.R. § 3.20 , that is collected, used or disclosed in accordance with 42 C.F.R. Part 3 . (e) Identifiable private information, as defined in 45 C.F.R. § 46.102 , that is collected, used or disclosed in accordance with 45 C.F.R. Part 46 . (f) Information used or shared as part of research conducted pursuant to 45 C.F.R. Part 46 or 21 C.F.R. Parts 50 and 56 or in accordance with the version of the Guideline for Good Clinical Practice prescribed by the International Council for Harmonisation of Technical Requirements

for Pharmaceuticals for Human Use published on November 9, 2016. (g) Information used only for public health activities and purposes, as described

in 45 C.F.R. § 164.512(b) , regardless of whether such information is subject to the Health Insurance Portability

and Accountability Act of 1996, Public Law 104-191 , and the regulations adopted pursuant thereto. (h) Personally identifiable information that is governed by and collected, used or

disclosed pursuant to: (1) Part C of Title XI of the Social Security Act, 42 U.S.C. §§ 1320d et seq. ; (2) The Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq. ; or (3) The Family Educational Rights and Privacy Act of 1974, 20 U.S.C. § 1232g , and the regulations adopted pursuant thereto. (i) Information and documents created for the purposes of compliance with the federal

Health Care Quality Improvement Act of 1986, 42 U.S.C. §§ 11101 et seq., and any regulations adopted pursuant thereto. (j) The collection or sharing of consumer health data where expressly authorized by

any provision of federal or state law. (k) Information processed by or for any governmental or tribal entity for civic or

governmental purposes and operations or related services and operations. (l) Any person who holds a nonrestricted license, as defined in NRS 463.0177 , or an affiliate, as defined in NRS 463.0133 , of such a person. (m) Law enforcement agencies, contractors of law enforcement agencies and law enforcement

activities. (n) Information that has been de-identified in accordance with the requirements for

de-identification set forth in 45 C.F.R. § 164.514 . 2. A third party that obtains consumer health data from a regulated entity through

a merger, acquisition, bankruptcy or other transaction through which the third party

assumes control of all or part of the assets of the regulated entity is deemed to

assume all obligations of the regulated entity to comply with the provisions of NRS 603A.400 to 603A.550 , inclusive.