Meet NRS 603A security and consumer health data rules with confidence

NRS 603A is Chapter 603A of the Nevada Revised Statutes, titled Security and Privacy of Personal Information. It requires data collectors to protect Nevada residents' personal information with reasonable security measures, encrypt it in certain transfers, destroy records securely and notify residents of breaches. It also contains Nevada's online privacy notice and sale opt-out rules and, since 2024, a consumer health data privacy law added by SB 370.

Nevada's consumer health data law is Senate Bill 370 of 2023, codified at NRS 603A.400 to 603A.550 and in force since 31 March 2024. It bars regulated entities from collecting or sharing consumer health data without consent unless needed for a requested product or service, requires a published privacy policy, gives consumers rights to confirm, list recipients, stop processing and delete, and bans selling health data without written authorisation.

Any person that conducts business in Nevada, or produces or provides products or services targeted to Nevada consumers, and determines the purpose and means of processing, sharing or selling consumer health data must comply. There is no revenue or data volume threshold. Exemptions include HIPAA covered entities, GLBA financial institutions and certain research and public health information, so health apps and wellness brands are the main focus.

A violation of the data security provisions or the consumer health data provisions is treated as a deceptive trade practice under Nevada's consumer protection law, enforced by the Attorney General. The Attorney General or a district attorney can also seek an injunction for security violations. The consumer health data provisions expressly create no private right of action, so individuals cannot sue directly under them.

A data collector must notify affected Nevada residents in the most expedient time possible and without unreasonable delay after discovering a breach of unencrypted personal information, subject to law enforcement needs and time to scope the breach. Notice can be written, electronic or substitute. If more than 1,000 people must be notified at once, the nationwide consumer reporting agencies must also be told.

NRS 603A does not apply its consumer health data rules to HIPAA covered entities, so it mainly reaches health and wellness businesses outside HIPAA. Its reasonable security duty has no prescribed framework for private companies, so controls from ISO 27001 or SOC 2 are a strong way to evidence it. Payment card businesses must comply with PCI DSS under NRS 603A.215.

A regulated entity must respond to a consumer request without undue delay and within 45 days of authenticating it, with one further 45 day extension allowed if it tells the consumer why. Deletion must happen within 30 days of authenticating the request. Appeals must be answered in writing within 45 days, including Attorney General contact details if the request is still refused.

Yes, on request. NRS 603A is mapped in OneClickComply's control library and available on request, rather than live as a standard adoptable framework today. Because controls are mapped across frameworks, evidence you collect for ISO 27001, SOC 2 or HIPAA can count towards Nevada's security and consumer health data duties. Our in-house audit team can advise on scope.