NJ A6050

Prohibits health care providers, mobile application developers, and third parties from acquiring or disclosing biometric data, health data, or protected health information of New Jersey residents without obtaining explicit consent

Requires consent before initial acquisition of personal health information; subsequent acquisitions do not require separate consent if the original consent explicitly authorized ongoing collection

Mandates separate consent obtained no more than three calendar days before each individual disclosure of personal health information to third parties

Exempts health care providers sharing information with other health care providers for medical treatment or diagnosis purposes, and preserves all existing HIPAA rights and obligations

Establishes a private right of action with damages of $1,000 per violation, plus reasonable attorney's fees and court costs