Nevada § 603A.535 - Unauthorized sale or offering of consumer health data prohibited; provision of goods or services conditioned upon authorization of sale of consumer health data prohibited; required contents of authorization; revocation; expiration; invalidity; provision and retention of copies

§ 603A.535. Unauthorized sale or offering of consumer health data prohibited; provision of goods or services conditioned upon authorization of sale of consumer health data prohibited; required contents of authorization; revocation; expiration; invalidity; provision and retention of copies

1. A person shall not sell or offer to sell consumer health data: (a) Without the written authorization of the consumer to whom the data pertains;

or (b) If the consumer provides such written authorization, in a manner that is outside

the scope of or inconsistent with the written authorization. 2. A person shall not condition the provision of goods or services on a consumer authorizing

the sale of consumer health data pursuant to subsection 1. 3. Written authorization pursuant to subsection 1 must be provided in a form written

in plain language which includes, without limitation: (a) The name and contact information of the person selling the consumer health data; (b) A description of the specific consumer health data that the person intends to

sell; (c) The name and contact information of the person purchasing the consumer health

data; (d) A description of the purpose of the sale, including, without limitation, the manner

in which the consumer health data will be gathered and the manner in which the person

described in paragraph (c) intends to use the consumer health data; (e) A statement of the provisions of subsection 2; (f) A statement that the consumer may revoke the written authorization at any time

and a description of the means established pursuant to subsection 4 for revoking the

authorization; (g) A statement that any consumer health data sold pursuant to the written authorization

may be disclosed to additional persons and entities by the person described in paragraph

(c) and, after such disclosure, is no longer subject to the protections of this section; (h) The date on which the written authorization expires pursuant to subsection 5;

and (i) The signature of the consumer to which the consumer health data pertains. 4. A person who sells consumer health data shall establish a means by which a consumer

may revoke a written authorization made pursuant to subsection 1. 5. Written authorization provided pursuant to subsection 1 expires 1 year after the

date on which the authorization is given. 6. A written authorization provided pursuant to subsection 1 is not valid if the written

authorization: (a) Was a condition for the provision of goods or services to the consumer in violation

of subsection 2; (b) Does not comply with the requirements of subsection 3; (c) Has been revoked pursuant to subsection 4; or (d) Has expired pursuant to subsection 5. 7. A person who sells consumer health data shall provide a copy of the written authorization

provided pursuant to subsection 1 to the consumer who signed the written authorization

and the purchaser of the consumer health data. 8. A seller and purchaser of consumer health data shall each retain a copy of the

written authorization provided pursuant to subsection 1 for at least 6 years after

the date on which the written authorization expired pursuant to subsection 5.