WeVote
Log In

Bill

Bill

S 74

An act relating to the collection, sharing, and selling of consumer health data

2025-2026 Regular Session Introduced by Martine Gulick and 2 co-sponsors

Vermont S.74 would require clear consent, restrict sale of identifiable health data, limit sharing, and boost transparency, security, and consumer rights for health data.

Read 1st time & referred to Committee on Health and Welfare
0
WeVote Research Nonpartisan
Bill Summary · S 74

Summary of Bill: S.74 (2025-2026) – Vermont

Title

An act relating to the collection, sharing, and selling of consumer health data

Purpose and intent

  • Establishes governing rules for how consumer health data may be collected, shared, and sold.
  • Aims to protect Vermonters’ health privacy while outlining permissible data practices for entities that handle health information.
  • Provides a framework for consent, transparency, and enforcement aimed at reducing unauthorized use or abuse of health data.

Key provisions and changes (highlights)

  • Data collection and use
    • Sets conditions under which health data may be collected from individuals.
    • Clarifies permissible purposes for collection (e.g., medical, research, product development) and restricts uses that may pose privacy risks.
  • Consent and notice
    • Requires clear, conspicuous informed consent for collection, sharing, or sale of health data.
    • Specifies information that must be included in notices (data types collected, purposes, retention periods, data recipients, and rights of the individual).
  • Sharing and sale of health data
    • Regulates with whom health data may be shared (e.g., third parties, affiliates, contractors) and for what purposes.
    • Governs sale of health data, including restrictions or prohibitions on selling identifiable health information without explicit consent.
  • Data minimization and de-identification
    • Encourages or requires practices to minimize data collection and to de-identify data when possible, with standards or methodologies for de-identification.
  • Consumer rights
    • Establishes rights for individuals to access their health data, request corrections, and delete data where feasible.
    • Provides mechanisms to opt out of certain data practices, including sale or targeted sharing.
  • Transparency and disclosures
    • Mandates public-facing privacy disclosures from entities handling health data, including data inventories, security measures, and contact information for complaints.
  • Security requirements
    • Sets baseline security standards for health data storage, transmission, and processing (e.g., encryption, access controls, incident response).
  • Enforcement and penalties
    • Creates or references enforcement mechanisms (e.g., a state agency or office) with potential penalties for noncompliance, including fines or corrective actions.
  • Preemption and coordination
    • Addresses whether state requirements align or conflict with federal or other state laws, and how Vermont will coordinate with existing health data regulations.

Who/what is affected

  • Entities handling Vermont residents’ health data, including:
    • Health care providers and systems
    • Health information exchanges and digital health platforms
    • Data brokers, researchers, app developers, and insurers
    • Contractors and service providers with access to health data
  • Vermont residents whose health data may be collected, shared, or sold
  • Potentially government agencies responsible for enforcing privacy protections and handling complaints

Procedural and timeline aspects

  • Action history indicates:
    • February 19, 2025: Read 1st time and referred to the Committee on Health and Welfare
  • As a first-stage referral, the bill will undergo committee review, including hearings, potential amendments, and stakeholder input.
  • After committee action, the bill would typically proceed to further floor votes in the Vermont General Assembly, with potential revisions and a final passage and potential veto considerations.
  • Effective dates and transition provisions (e.g., phased implementation, grace periods) would be specified in the bill text; if not explicit in the summary, they will be determined during the committee/legislative process.

Potential impacts (high-level)

  • Strengthened privacy protections for health data, with clearer consent requirements and limited ability to sell identifiable information.
  • Increased transparency for consumers about how their health data is used and shared.
  • Enhanced security and accountability for organizations handling sensitive health information.
  • Possible compliance obligations for a wide range of entities, including smaller tech and data-analytic firms, to align operations with Vermont’s standards.

If you’d like, I can tailor this summary to focus on specific stakeholder groups (consumers, healthcare providers, data companies) or compare it to existing Vermont privacy laws.

Compiled from official sources — confirm details with the bill’s official record.

Sign in to ask a question.