How State General Privacy Laws Apply to Healthcare Providers

Exempts PHI in the hands of a covered entity or business associate

Yes (Cal. Civ. Code § 1798.146(a)(1))

Yes (Colo. Rev. Stat. § 6-1-1304(2)(a))

Yes (Conn. Pub. Act 22-15 § 3(b)(1))

Yes (Utah Code Ann. § 13-61-102(2)(g)(i))

Yes (Va. Code Ann. § 59.1-576(C)(1))

Exempts HIPAA-covered entities completely (not limited to PHI)

No (but does exempt patient information maintained by a covered entity in the same manner as PHI, Cal. Civ. Code § 1798.146(a)(2))

No (but does exempt information maintained by a covered entity in the same manner as PHI, Colo. Rev. Stat. § 6-1-1304(2)(g))

Yes (Conn. Pub. Act 22-15 § 3(a)(6))

Yes (Utah Code Ann. § 13-61-102(2)(e))

Yes (Va. Code Ann. § 59.1-576(B)(iii))

Exempts Non-Profits

Yes (except for a non-profit that controls or is controlled by a business, as defined in Cal. Civ. § 1798.140(d)(1), and that shares common branding with the business and with whom the business shares consumers' personal information, see Cal. Civ. § 1798.140(d)(2))

No

Yes (Conn. Pub. Act 22-15 § 3(a)(2))

Yes (Utah Code Ann. § 13-61-102(2)(d))

Yes (Va. Code Ann. § 59.1-576(B)(iv))

Applies to employee information

Yes

No (definition of "consumer" at Colo. Rev. Stat. § 6-1-1303(6)(b))

No (definition of "consumer" at Conn. Pub. Act 22-15 § 1(7))

No (definition of "consumer" at Utah Code Ann. § 13-61-101(10)(b))

No (definition of "consumer" at Va. Code Ann. § 59.1-575)

Excludes HIPAA de-identified information derived from PHI

Yes (Cal. Civ. Code § 1798.146(a)(4)), except places contracting restrictions on sale or license of HIPAA de-identified information, which applies to non-profits (Cal. Civ. Code § 1798.148(c))

Yes (Colo. Rev. Stat. § 6-1-1304(2)(g))

Yes (Conn. Pub. Act 22-15 § 3(b)(8))

Yes (Utah Code Ann. § 13-61-102(2)(g)(ix))

Yes (Va. Code Ann. § 59.1-576(C)(7))

Applicability threshold*

A for-profit that does business in California with $25 million in gross revenue in the preceding year (not limited to California revenue) or that buys, sells, or shares the personal information of 100,000 or more California residents or their households; or a non-profit that controls or is controlled by such a for-profit and shares common branding. (Cal. Civ. § 1798.140(d))

Conducts business in Colorado or produces or delivers commercial products or services that are intentionally targeted to residents of Colorado and (1) controls or processes the personal data of 100,000 or more Colorado residents during a calendar year; or (2) derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of 25,000 or more Colorado residents. (Colo. Rev. Stat. § 6-1-1304(1))

Conducts business in Connecticut or produces products or services that are targeted to Connecticut residents and during the preceding calendar year controlled or processed the personal data of 100,000 or more Connecticut residents, excluding personal data controlled or processed solely for the purpose of completing a payment transaction. (Conn. Pub. Act 22-15 § 2)

Conducts business in Utah or produces a product or service that is targeted to Utah residents, has annual revenue of $25 million or more (not limited to Utah revenue), and during a calendar year controls or processes personal data of 100,000 or more Utah residents. (Utah Code Ann. § 13-61-102(1))

Conducts business in Virginia or produces products or services that are targeted to residents of Virginia and during a calendar year controls or processes personal data of at least 100,000 Virginia residents. (Va. Code Ann. § 59.1-576(a))