Connecticut. Health data. Act
CT consumer health dataConnecticut consumer health data provisions (SB 3, Public Act 23-56, amending the CTDPA)
In force
Partly verified
Medium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
§1Summary
- Synopsis
Adds consumer health data as sensitive data, requires consent to process or sell it, imposes confidentiality and access limits on employees and processors, and bans geofencing near health facilities.
- Key themes
- Unique features
Health data duties apply to any 'person', not only controllers meeting CTDPA thresholds.
- SaaS relevance
Health-adjacent SaaS with Connecticut users are caught even below CTDPA thresholds.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- See Conn. Gen. Stat. § 36a-701b
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $5,000 per wilful violation (CUTPA)
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text cga.ct.gov
- Authority
- Connecticut Attorney General
§5Where it applies
- Domestic law of
- Connecticut
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.