VT S0074

Creates the "Vermont My Health My Data Act" to regulate collection, sharing, and selling of consumer health data by entities not covered by HIPAA, effective January 1, 2026

Requires regulated entities to obtain separate opt-in consent before collecting consumer health data, sharing it with third parties, or selling it, with sales requiring a signed written authorization that expires after one year

Grants consumers the right to confirm what health data is collected about them, withdraw consent, and request deletion of their data within 45 days of request

Prohibits geofencing within 1,850 feet of any health care facility, including mental health and reproductive health facilities, for purposes of tracking or collecting consumer health data

Violations are enforceable under Vermont's Consumer Protection Act by the Attorney General, with private rights of action available; exempts HIPAA-covered entities, data governed by Gramm-Leach-Bliley, Fair Credit Reporting Act, and certain research data