Law / United States / 
Nevada
Consumer Health Data, access, disclosure, and deletion rights
In force since .
A data subject rights rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Give a Nevada consumer the right to access their consumer health data, obtain a list of third parties it was disclosed to, stop its collection, sharing, or sale, and delete it.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P4
- Respond to a consumer health data rights request within 45 days, with one 45-day extension available, and provide at least two free responses per consumer per year.NIST Privacy FrameworkCT.PO-P3
- Do not treat this right as reaching personal data outside the consumer health data sector. It does not create a general access, deletion, or portability right.
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Must a regulated entity complete a deletion within 30 days after authenticating the request under NRS 603A.515(1) although NRS 603A.510(1) allows 45 days, extendable by 45 more, to respond to a request made under NRS 603A.505?
What it makes you log
Logging duty
The sections cited require affirmative, voluntary consent before collecting or sharing consumer health data (603A.500), confirmation, a list of third parties, cessation and deletion on a consumer's request (603A.505), a response within 45 days (603A.510) and deletion within 30 days with notice to those who received the data (603A.515), which may be delayed for backups for up to two years. Consent is a condition of processing and the sections do not say the entity must be able to show it. The burden of showing that a fee was justified (603A.510(4)) concerns a fee in a civil challenge, not consent or lawfulness. No log or record duty, audit or regulator access appears in these sections. The duty to retain a copy of a written authorization to sell for at least six years after it expires sits in 603A.535(8), and the reach test (a regulated entity conducting business in this State or targeting consumers here, 603A.465) sits outside the cited sections, so neither is carried on this row.
- Kind
- None
- As of
What this law does
A regulated entity processing consumer health data must give a Nevada consumer the right to access it, obtain a list of third parties it was disclosed to, stop its collection, sharing, or sale, and delete it, sector-scoped to health data rather than a general personal-data right. A controller must respond within 45 days, with one 45-day extension available, and must provide two free responses per consumer per year.
Senate Bill 370 of 2023 (chapter 525, Statutes of Nevada 2023), which enacted these sections, became effective on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .