Does Connecticut's consumer health data law apply to your business?

Connecticut did not pass a standalone health-privacy statute the way Washington and Nevada did. It bolted consumer health data rules onto its existing Data Privacy Act in 2023, and the result is easy to miss if you only read the main comprehensive law. The health-data provisions carry their own geofencing ban and their own consent rule, and one of them reaches any business, including those far below the size that triggers the comprehensive act.

What is consumer health data in Connecticut?

Under Conn. Gen. Stat. section 42-515, consumer health data is personal data that is used to identify a consumer's past, present, or future physical or mental health condition or diagnosis. The definition expressly includes gender-affirming health data and reproductive or sexual health data. That framing is deliberately broad. A period-tracking app, a pharmacy loyalty program, a telehealth booking flow, or an ad audience built around a health interest can all be handling consumer health data, even though none of them is a hospital and none is covered by HIPAA.

The geofencing ban that applies to everyone

The sharpest rule sits in section 42-526. No person may use a geofence to build a virtual boundary within 1,750 feet of any mental health facility or reproductive or sexual health facility for the purpose of identifying or tracking consumers, collecting data from them, or sending them notifications related to their consumer health data. The statute says "no person," so this ban does not wait for you to cross the comprehensive law's revenue or volume thresholds. If you run location-based advertising anywhere near a clinic, this provision reaches you regardless of your size.

Consent to sell, and limits on access

Section 42-526 also controls the data itself. You cannot sell, or offer to sell, consumer health data without first obtaining the consumer's consent, which has to be a clear affirmative act, not a pre-checked box. You may not give an employee or contractor access to consumer health data unless they are bound by a contractual or statutory duty of confidentiality, and you may not hand it to a processor unless that processor is under a section 42-521 data processing contract. These duties attach to the entity that decides why and how the health data is processed.

How it fits with the Connecticut Data Privacy Act

The health-data rules live inside the Connecticut Data Privacy Act but stand partly on their own. The comprehensive act still governs controller thresholds, consumer rights, and sensitive-data consent, while section 42-526 adds the geofencing ban and the health-data sale and access limits on top. Connecticut joined Washington and Nevada in treating health signals as their own category, so if you operate across states, line this up with the Washington My Health My Data Act and Nevada consumer health data law.

Next step

If you collect anything that hints at health and you reach Connecticut consumers, the free 2-minute Obligation Scan checks whether the consumer health data rules apply and lists the consent, access, and geofencing steps you owe, so a location pixel near a clinic does not become an Attorney General matter. The US state privacy laws hub shows how data-type laws like this one sit alongside the comprehensive state laws.