Vermont Enacts Privacy Legislation to Regulate Health-Related Information
Vermont has passed two health-focused privacy laws: H.639, which regulates direct-to-consumer genetic testing companies, and S.71, a broader privacy act that adds extra protections for consumer health data. Both measures expand the state's oversight of how sensitive personal health information is collected and used.
Why this matters: Genetic data is not like a password. You cannot change it, and it does not just describe you — it describes your relatives too. Direct-to-consumer DNA companies have had a rough few years on privacy, including a major breach and a bankruptcy that put customer data at risk. Vermont is now telling those companies that they have real obligations. The broader health data law matters because most people assume their health information is already protected. Often it is not, especially when it flows through apps and wellness platforms that fall outside federal health privacy rules.
Who should care: Healthcare professionals · Privacy officers · Compliance · Lawyers · Cybersecurity · General readers · Policy
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.