The civic record
Read. Follow. Verify.Vermont Regulates Consumer Health Data Collection, Sharing, and Sales Effective January 1, 2026
Last action · February 19, 2025: Read 1st time & referred to Committee on Health and WelfareSponsors: Virginia Lyons and 2 others
Track this bill to get notified when it advances a stage. One tap to stop, anytime.
What This Bill Would Do
Vermont lawmakers propose the My Health My Data Act, requiring regulated entities and small businesses to obtain explicit consumer consent before collecting or sharing consumer health data, prohibiting data sales without valid written authorization, and banning s near health care facilities starting January 1, 2026.
Residents gain explicit legal rights to access, correct, delete, and withdraw consent for the collection and sharing of their sensitive health information by non-traditional health entities like apps and websites, backed by enforcement under the Vermont Consumer Protection Act.
- Sen. Virginia Lyons introduced S.74 during the 2025-2026 legislative session in the Vermont upper house. context
- The Health Insurance Portability and Accountability Act of 1996 (HIPAA) serves as the primary federal baseline for protected health information, though it primarily applies to traditional health care providers, clearinghouses, and health plans. context
Who It Would Affect
Groups the bill's text would affect if enacted, as described in the record. Being affected is not a position for or against it.
Vermont consumers
Consumers gain rights to access, correct, delete, and control the sharing and selling of their personal health data.
Regulated entities and small businesses
Businesses must establish privacy policies, obtain affirmative consumer consents, maintain strict data security practices, and process consumer deletion requests.
Processors
Processors are bound by specific contracts limiting data processing actions and must assist regulated entities in fulfilling statutory obligations.
Key Facts
- The act establishes the 'Vermont My Health My Data Act' to regulate consumer health data privacy starting January 1, 2026.
- Regulated entities and small businesses must maintain a clear and conspicuous consumer health data privacy policy published on their homepage.
- Collecting consumer health data requires explicit consumer consent for a specified purpose, or must be necessary to provide a requested product or service.
- Sharing consumer health data requires a separate and distinct consent from the consent obtained for collection.
Show all 12 facts
- Consumers have the right to confirm whether their health data is being collected, shared, or sold, and to access that data free of charge up to twice annually.
- Consumers hold the right to have their health data deleted, and businesses must delete the data from networks and notify all third parties within a window not exceeding six months for backups.
- Regulated entities must comply with consumer rights requests without undue delay and within 45 days of receipt.
- Selling or offering to sell consumer health data requires a separate, valid written authorization that expires after one year and cannot be bundled with other terms.
- Implementing a geofence within 1,850 feet of any health care facility, mental health facility, or reproductive or sexual health facility for health data collection or tracking is strictly unlawful.
- Violations of the subchapter are treated as violations of the Vermont Consumer Protection Act under 9 V.S.A. chapter 63.
- Small businesses are defined as entities that collect or process health data for fewer than 100,000 consumers, or derive under 50 percent of gross revenue from health data while handling fewer than 25,000 consumers.
- Specific exemptions apply to entities and information already governed by HIPAA, the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, FERPA, and designated human subjects research.
Frequently Asked Questions
What types of information are included under consumer health data?
How long do businesses have to respond to a consumer data request?
Are small businesses exempt from these requirements?
What else do you want to know?
News Coverage
Follow the record
Votes, people, money & the original sourceWhere This Stands
Currently in committee. The next step in the legislative lifecycle is Floor Vote.
Procedural history
1 action- Feb 19, 2025SenateIntroducedRead 1st time & referred to Committee on Health and Welfare
Version history
Only one version on file - nothing to compare yet. As later stages (committee substitute, engrossed, enrolled) are captured, the redline appears here.
View official text →Lobbying Activity
No state lobbying filings in our records match this bill. Federal lobbying reports (LDA) cover Congress, so they are not listed on state bills.
Full breakdown
Who this bill affects and the strongest case for and against it, written only from the bill’s own text.
Sponsors
Discoveries
Patterns POLISCOPE noticed across the record. These are observations to investigate, not conclusions.
Expansion of Health Privacy Beyond HIPAA
The bill intentionally addresses the regulatory gap where non-covered entities such as mobile applications and websites collecting health data are not subject to federal HIPAA rules.
Connected Entities
Sources
legislature.vermont.gov
Analysis Score
0–100- Significance85How much this matters to a regular citizen
- Controversy60Intensity of disagreement among stakeholders
- Entertainment10Compellingness for a non-policy-wonk reader
- Buzz45Current news / social attention level
Publisher tools