Nevada
Nevada consumer health data law (SB 370)
Nevada’s consumer health data law, similar to Washington’s. Applies to businesses of any size that handle consumer health data.
- Status
- In effect since March 31, 2024
- Citation
- Nev. Rev. Stat. ch. 603A (SB 370, 2023)
- Official text
- Read the law(opens in a new tab)
Who it covers
Any business that collects consumer health data from Nevada residents.
What it asks of your website
- Publish a consumer health data privacy policy.
- Get consent before collecting or sharing consumer health data; written authorization before selling it.
- Let people see and delete their health data.
- Don’t geofence near health care facilities.
Who has to comply
Nevada’s consumer health data law (SB 370, NRS 603A.400 to .550) took effect on March 31, 2024. It applies to anyone who does business in Nevada or targets Nevada consumers and decides how consumer health data is processed, shared or sold. There’s no size threshold. HIPAA entities, Gramm-Leach-Bliley financial institutions and some others are exempt.
“Consumer health data” means personal information linked to a consumer’s health, and includes data inferred from non-health information. Shopping data that isn’t used to identify health status is excluded.
Policy and consent
- Post a consumer health data privacy policy, linked conspicuously on your main website.
- Collect health data only with affirmative consent, or where needed for what the consumer asked for.
- Share it only with a separate consent, obtained before sharing.
- Sell it only with the consumer’s written authorization, which expires after one year. You can’t make a service depend on it.
Rights and the geofencing ban
- Rights to confirm collection, sharing or sale, get a list of third parties, stop collection, sharing or sale, and delete.
- Respond within 45 days of authenticating a request, extendable by 45 more; at least two free requests a year.
- Delete within 30 days; backups can take up to two years.
- Appeals: answer within 45 days.
Geofencing within 1,750 feet of a medical facility to track people, collect health data or send health ads is banned.
Enforcement
A violation is a deceptive trade practice under Nevada law, enforced by state officials including the Attorney General, who can seek civil penalties, restitution and damages. Unlike Washington’s similar law, Nevada’s gives no private right of action.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Copy and delete requests (Pro)
Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.
Consumer Health Data Privacy Policy (Pro)
A separate health data policy page, built and kept current like the free policies.
A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
Can consumers sue under Nevada’s health data law?
No. Unlike Washington’s My Health My Data Act, it gives no private right of action.
Does it cover inferred health data?
Yes. Data derived or inferred from non-health information counts.
How far does the geofencing ban reach?
1,750 feet from a medical facility.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
