House Bill 1268 Summary

• Establishes the "Mississippi Protect Health Data Privacy Act" requiring regulated entities to disclose health data privacy policies that specify what health data is collected, purposes for collection, categories of third parties receiving data, and consumer rights.

• Prohibits regulated entities from collecting, sharing, or selling health data without consumer consent, except when strictly necessary to provide requested products or services; requires valid written authorization for health data sales with specific disclosures including purchaser identity, purpose, and one-year expiration.

• Grants consumers rights to withdraw consent, confirm whether their health data is being collected or sold, request deletion of their health data within 45 calendar days, and prohibits discriminatory treatment against consumers who withhold consent.

• Bans geofencing technology (within 1,750 feet) around health service facilities to send notifications or track consumer location data.

• Establishes private right of action in circuit court with liquidated damages of $1,000 for negligent violations or $5,000 for intentional/reckless violations, plus attorney fees; authorizes Attorney General enforcement; effective July 1, 2024.