Vermont S. 74: An act relating to incentives for lower education spending

Bill Text

BILL AS INTRODUCED S.74
2025 Page 1 of 30

VT LEG #379087 v.1
S.74 1
Introduced by Senators Lyons, Gulick and Harrison 2
Referred to Committee on 3
Date: 4
Subject: Health; health information; data privacy 5
Statement of purpose of bill as introduced: This bill proposes to regulate the 6
collection, sharing, and selling of consumer health data in Vermont. 7
An act relating to the collection, sharing, and selling of consumer health 8
data 9
It is hereby enacted by the General Assembly of the State of Vermont: 10
Sec. 1. 18 V.S.A. chapter 42B is amended to read: 11
42B. HEALTH CARE PRIVACY 12
Subchapter 1. Disclosure of Protected Health Information 13
§ 1881. DISCLOSURE OF PROTECTED HEALTH INFORMATION 14
PROHIBITED 15
* * * 16
Subchapter 2. Vermont My Health My Data Act 17
§ 1891a. SHORT TITLE 18
This subchapter shall be known and may be cited as the “Vermont My 19
Health My Data Act.” 20

BILL AS INTRODUCED S.74
2025 Page 2 of 30

VT LEG #379087 v.1
§ 1891b. FINDINGS AND INTENT 1
(a) Findings. The General Assembly finds that: 2
(1) The residents of Vermont regard their privacy as a fundamental right 3
and an essential element of their individual freedom. Fundamental privacy 4
rights have long been and continue to be integral to protecting Vermonters and 5
to safeguarding our democratic republic. 6
(2) Information related to an individual’s health conditions or attempts 7
to obtain health care services is among the most personal and sensitive 8
categories of data collected. Vermonters expect that their health data is 9
protected under laws like the Health Insurance Portability and Accountability 10
Act of 1996 (HIPAA). However, HIPAA only covers health data collected by 11
specific health care entities, including most health care providers. Health data 12
collected by noncovered entities, including certain applications and websites, 13
are not afforded the same protections. This act works to close the gap between 14
consumer knowledge and industry practice by providing stronger privacy 15
protections for all of Vermont consumers’ health data. 16
(b) Intent. By enacting this subchapter, it is the intent of the General 17
Assembly to provide heightened protections for Vermonters’ health data by: 18
(1) requiring additional disclosures and consumer consent regarding the 19
collection, sharing, and use of their health data; 20

BILL AS INTRODUCED S.74
2025 Page 3 of 30

VT LEG #379087 v.1
(2) empowering consumers with the right to have their health data 1
deleted; 2
(3) prohibiting the selling of consumer health data without valid 3
authorization signed by the consumer; and 4
(4) making it unlawful to utilize a geofence around a facility that 5
provides health care services. 6
§ 1891c. DEFINITIONS 7
As used in this subchapter: 8
(1) “Abortion” means any medical treatment intended to induce the 9
termination of, or to terminate, a clinically diagnosable pregnancy except for 10
the purpose of producing a live birth. 11
(2) “Affiliate” means a legal entity that shares common branding with 12
another legal entity and controls, is controlled by, or is under common control 13
with another legal entity. For purposes of this definition, “control” or 14
“controlled” means any one or more of the following: 15
(A) ownership of, or the power to vote, more than 50 percent of the 16
outstanding shares of any class of voting security of a company; 17
(B) control in any manner over the election of a majority of the 18
directors or of individuals exercising similar functions; or 19
(C) the power to exercise controlling influence over the management 20
of a company. 21

BILL AS INTRODUCED S.74
2025 Page 4 of 30

VT LEG #379087 v.1
(3) “Area agency on aging” has the same meaning as in 33 V.S.A. 1
§ 6203. 2
(4) “Authenticate” means to use reasonable means to determine that a 3
request to exercise any of the rights afforded in this chapter is being made by 4
or on behalf of the consumer who is entitled to exercise those consumer rights 5
with respect to the consumer health data at issue. 6
(5) “Biometric data” means data that is generated from the measurement 7
or technological processing of an individual’s physiological, biological, or 8
behavioral characteristics and that identifies a consumer, whether individually 9
or in combination with other data. Biometric data includes: 10
(A) imagery of the iris, retina, fingerprint, face, hand, palm, vein 11
patterns, and voice recordings, from which an identifier template can be 12
extracted; and 13
(B) keystroke patterns or rhythms and gait patterns or rhythms that 14
contain identifying information. 15
(6) “Collect” means to buy, rent, access, retain, receive, acquire, infer, 16
derive, or otherwise process consumer health data in any manner. 17
(7)(A) “Consent” means a clear affirmative act that signifies the 18
consumer’s freely given, specific, informed, opt-in, voluntary, and 19
unambiguous agreement, which may include written consent provided by 20
electronic means. 21

BILL AS INTR