Vermont committee continues S.71 privacy markup, debates HIPAA exemptions and business burdens

The Vermont House Committee on Commerce and Economic Development resumed consideration of S.71 on May 14, 2026, continuing a line-by-line review of definitions, exemptions and consumer rights. The session focused on when the bill would apply, HIPAA-related exemptions for health providers, and practical burdens the bill would place on small businesses.

Rick Sele of the Office of Legislative Council led the committee through the draft. He summarized the bill's primary coverage thresholds: a controller that "controls or processes the personal data of not fewer than 35,000 consumers" (Vermont residents) would fall under S.71, and any controller that processes consumer "sensitive data" would meet the threshold regardless of the number of consumers. Sele said the sensitive-data trigger would capture entities "one or more" processing such data and that the drafters modeled parts of the bill on recent Connecticut language.

Committee members questioned the sensitive-data trigger. One member said the clause "pushes…