Nevada § 603A.495 - Regulated entity required to develop and maintain policy concerning privacy of consumer health data; policy to be posted on Internet website maintained by regulated entity; prohibited acts

§ 603A.495. Regulated entity required to develop and maintain policy concerning privacy of consumer health data; policy to be posted on Internet website maintained by regulated entity; prohibited acts

1. A regulated entity shall develop and maintain a policy concerning the privacy of

consumer health data that clearly and conspicuously establishes: (a) The categories of consumer health data being collected by the regulated entity

and the manner in which the consumer health data will be used; (b) The categories of sources from which consumer health data is collected; (c) The categories of consumer health data that are shared by the regulated entity; (d) The categories of third parties and affiliates with whom the regulated entity

shares consumer health data; (e) The purposes of collecting, using and sharing consumer health data; (f) The manner in which consumer health data will be processed; (g) The procedure for submitting a request pursuant to NRS 603A.505 ; (h) The process, if any such process exists, for a consumer to review and request

changes to any of his or her consumer health data that is collected by the regulated

entity; (i) The process by which the regulated entity notifies consumers whose consumer health

data is collected by the regulated entity of material changes to the privacy policy; (j) Whether a third party may collect consumer health data over time and across different

Internet websites or online services when the consumer uses any Internet website or

online service of the regulated entity; and (k) The effective date of the privacy policy. 2. A regulated entity shall post conspicuously on the main Internet website maintained

by the regulated entity a hyperlink to the policy developed pursuant to subsection

1 or otherwise provide that policy to consumers in a manner that is clear and conspicuous. 3. A regulated entity shall not: (a) Collect, use or share categories of consumer health data, other than those included

in the privacy policy pursuant to paragraph (c) of subsection 1, without disclosing

those additional categories to each consumer whose data will be collected, used or

shared and obtaining the affirmative, voluntary consent of the consumer; (b) Share consumer health data with a third party or affiliate, other than those included

in the privacy policy pursuant to paragraph (d) of subsection 1, without disclosing

those additional third parties or affiliates to each consumer whose data will be shared

and obtaining the affirmative, voluntary consent of the consumer; (c) Collect, use or share consumer health data for purposes other than those included

in the privacy policy pursuant to paragraph (e) of subsection 1 without disclosing

those additional purposes to each consumer whose data will be collected, used or shared

and obtaining the affirmative, voluntary consent of the consumer; or (d) Enter into a contract pursuant to NRS 603A.530 with a processer 1 to process consumer health data that is inconsistent with the privacy policy. 1

So in original.