Summary
Establishes consumer privacy protections, including opt-outs from solely automated profiling producing significant decisions about healthcare services. Requires data-protection assessments for specified risky processing.
Healthcare Implications
Covered health-related consumer services must assess applicable profiling and honor opt-out rights. HIPAA-covered entities and business associates, protected health information, and health records are exempt; the law does not generally require clinician review of AI decisions.
Operational Implications
- Conduct and document assessments for profiling presenting specified foreseeable risks and other listed processing; make assessments available to the Attorney General on request.