Relating to protecting the privacy of the personal health data of residents of this state; and declaring an emergency.

Prohibits covered organization from collecting, using or disclosing personal health data about resident individual who has not given affirmative express consent for collection, use or disclosure unless in context of employment relationship or to comply with legal obligation , or unless personal health data was lawfully available to public from federal, state or local government records, was collected before emergency period for reasons other than tracking, monitoring or tracing resident individual's exposure to or infection by SARS-CoV-2 or COVID-19 or has been deidentified in accordance with federal law . Prohibits covered organization from retaining, storing or using personal health data and requires covered organization to destroy, delete or render inaccessible personal health data not later than specified dates unless personal health data consists of aggregations, statistical analyses, compilations or interpretations and covered organization takes reasonable measures to ensure that personal health data does not and cannot personally identify resident individual ] deidentifies personal health data in accordance with federal law . Requires covered organization to collect, receive or use ] collect, use, receive, process, examine, disclose or collate only personal health data only for specified purposes ] that is reasonably necessary to provide services to resident individual and to provide resident individual with certain disclosures and ability to revoke affirmative express consent for collection, receipt or use of personal health data except in specified circumstances. Punishes violation of Act as unlawful trade practice. Sunsets Act 270 days after COVID-19 emergency period, as defined in Act, ends. Declares emergency, effective on passage.