Processes personal data, in New Hampshire

RSA 141-H:2 · Read the law's page

• Do not require an individual or a member of the individual's family to undergo genetic testing as a condition of doing business with you (RSA 141-H:2, I).
• Obtain the prior written and informed consent of the individual to be tested, or of the parent, guardian, custodian or conservator, before any genetic testing is done in New Hampshire on an individual, or anywhere on a New Hampshire resident based on bodily materials obtained in New Hampshire, unless one of the exceptions in RSA 141-H:2, II applies (RSA 141-H:2, II).
• Provide test results only to the persons the individual approves in writing, and do not refuse to do business with an individual solely because the individual declines to consent to providing the results to some or all persons (RSA 141-H:2, II).
• Do not disclose that an individual has undergone genetic testing, or the results, without the prior written and informed consent of the individual, except as RSA 141-H:2, II and RSA 141-J allow (RSA 141-H:2, III).

RSA 141-H:4, 141-H:5 · Read the law's page

• If you are a health insurer, do not require or request, directly or indirectly, any individual or member of the individual's family to undergo genetic testing, or to reveal whether the individual or a family member has undergone genetic testing or the results (RSA 141-H:4, I and II).
• Do not condition health insurance coverage or health care benefits on whether an individual or a family member has undergone genetic testing or the results, and do not consider that in the determination of rates or any other aspect of coverage or benefits (RSA 141-H:4, III and IV).
• If you provide life, disability income or long-term care insurance and obtain information about genetic testing of an individual or a family member, do not use that information in writing a type of insurance coverage other than life, disability income or long-term care insurance (RSA 141-H:5, II).

RSA 359-C:19-21 · Read the law's page

• If you do business in New Hampshire and own or license computerized data that includes personal information, notify affected individuals as soon as possible once you determine that misuse has occurred or is reasonably likely to occur, or if you cannot make that determination; also notify your primary regulator, or the Attorney General's office if you have none, stating the anticipated date of the notice to individuals and the approximate number of individuals in this state who will be notified.
• Notify consumer reporting agencies once notice is required for more than 1,000 residents.
• Expect an injured individual to be able to sue for damages, including treble damages for a willful or knowing violation, unlike New Hampshire's comprehensive privacy act.

RSA 332-I:4 to 332-I:6 · Read the law's page

• If you are a health care provider or a business associate of one, obtain an authorization for any use or disclosure of protected health information for marketing, meeting the HIPAA authorization specifications for marketing (RSA 332-I:4, I).
• For fundraising uses of protected health information, give each intended recipient a clear and conspicuous opportunity to elect not to receive fundraising communications, and treat an election as a revocation of authorization (RSA 332-I:4, II).
• Do not disclose protected health information used for marketing or fundraising by voice mail, an unattended facsimile, or other methods of communication that are not secure (RSA 332-I:4, III).
• Promptly notify in writing the individuals whose protected health information was disclosed when a use or disclosure is allowed under federal law but not permitted by RSA 332-I:4; a business associate bears the cost of notice for its own disclosures (RSA 332-I:5).

RSA 507-H:1, XIV and XXV; RSA 507-H:9 · Read the law's page

• To hold data as de-identified under the New Hampshire Data Privacy Act, take reasonable measures to ensure the data cannot be associated with an individual (RSA 507-H:9, I(a)).
• Publicly commit to maintaining and using de-identified data without attempting to reidentify it (RSA 507-H:9, I(b)).
• Contractually obligate every recipient of de-identified data to comply with all provisions of the chapter (RSA 507-H:9, I(c)).
• When you disclose pseudonymous or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments attached to it, and take appropriate steps to address any breach of those commitments (RSA 507-H:9, V).

RSA 507-H:11 · Read the law's page

• Expect NHDPA violations to be enforced exclusively by the New Hampshire Attorney General, never by a private plaintiff.
• Cure a noticed violation within 60 days of an Attorney General notice of violation to avoid a civil penalty of up to $10,000 per violation under New Hampshire's unfair trade practices law.

RSA 507-H:2, 507-H:6, 507-H:7, 507-H:10 · Read the law's page

• Determine whether you conduct business in New Hampshire, or produce a product or service targeted to New Hampshire residents, and controlled or processed the personal data of at least 35,000 unique consumers, or 10,000 consumers while deriving more than 25 percent of gross revenue from selling personal data, before relying on any NHDPA exemption.
• Limit personal data collection to what is adequate, relevant, and reasonably necessary, and describe your purposes in a privacy notice.
• Confirm a processor you use acts only on your instructions and assists with rights requests, security, and breach notification.

RSA 507-H:4 · Read the law's page

• Give a New Hampshire consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Offer a New Hampshire consumer an opt-out of targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects.
• Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 45-day extension available, and decide an appeal of a refusal within 60 days.

RSA 507-H:8 · Read the law's page

• Conduct and document a data protection assessment for each of your processing activities that presents a heightened risk of harm to a New Hampshire consumer, including targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair treatment, injury, intrusion or other substantial injury, and the processing of sensitive data (RSA 507-H:8, I).
• In each assessment, identify and weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer as the safeguards you employ mitigate them, and factor in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer (RSA 507-H:8, II).
• Make a data protection assessment available to the attorney general when the attorney general requires its disclosure for an investigation (RSA 507-H:8, III).