Summary
Establishes privacy rights, including an opt-out from solely automated profiling producing legally or similarly significant decisions, expressly including healthcare services. Requires assessments for specified risky processing.
Healthcare Implications
Nonexempt health-related data controllers must support applicable profiling opt-outs and assessments. HIPAA-covered entities and business associates, protected health information, and specified health records are exempt; this is not a general clinical-AI review mandate.
Operational Implications
- Document assessments for profiling presenting specified foreseeable risks and other covered processing; provide them to the Attorney General on request. Assessments apply to processing activities that commence on or after January 1, 2027; they are not retroactive.