Connecticut Privacy Laws: A Practical Guide for Independent Pathology Practices

Connecticut Data Privacy Act Overview

What the CTDPA does

The Connecticut Data Privacy Act (CTDPA) took effect on July 1, 2023. It grants Connecticut residents rights over their personal data and imposes guardrails on personal data processing by businesses, including notice, data minimization, sensitive-data consent, and opt-out controls for sales, targeted advertising, and certain profiling. As of January 1, 2025, controllers must honor universal opt-out preference signals (such as the Global Privacy Control) sent by Connecticut consumers. ([portal.ct.gov](https://portal.ct.gov/AG/Sections/Privacy-/The-Connecticut-Data-Privacy-Act?trk=article-ssr-frontend-pulse_little-text-block))

Who the CTDPA covers

In general, the CTDPA applies to businesses that conduct business in Connecticut or target Connecticut residents and either processed personal data of at least 35,000 consumers in the prior year, processed sensitive data, or offered personal data for sale. Separately, the law applies to all “Consumer Health Data Controllers” regardless of size thresholds. ([portal.ct.gov](https://portal.ct.gov/AG/Sections/Privacy-/The-Connecticut-Data-Privacy-Act?trk=article-ssr-frontend-pulse_little-text-block))

Key rights Connecticut residents can exercise

• Access and data portability for personal data (including inferences)
• Correction of inaccuracies
• Deletion (including data obtained from third parties)
• Opt-out of sale, targeted advertising, and certain profiling
• A list of third parties to whom personal data was sold (or a general list if consumer-specific lists are not maintained)

Controllers must provide clear instructions and timely response pathways for these requests. ([portal.ct.gov](https://portal.ct.gov/AG/Sections/Privacy-/The-Connecticut-Data-Privacy-Act?trk=article-ssr-frontend-pulse_little-text-block))

Consumer Health Data Restrictions

Scope and prohibitions

Connecticut added targeted protections for consumer health data. Unless an exemption applies, a person may not: (1) grant employee or contractor access to consumer health data unless bound by confidentiality; (2) provide a processor with access unless a compliant processing contract is in place; (3) use a geofence within 1,750 feet of any mental health, reproductive, or sexual health facility to identify, track, collect data from, or send notifications to a consumer about their consumer health data; or (4) sell consumer health data without first obtaining the consumer’s consent. ([codes.findlaw.com](https://codes.findlaw.com/ct/title-42-business-selling-trading-and-collection-practices/ct-gen-st-sect-42-526/?utm_source=openai))

What this means for pathology practices

Many independent pathology practices are HIPAA-covered entities. The consumer health data restrictions include a carve‑out for HIPAA covered entities and business associates, so these specific restrictions generally do not apply to such practices; however, you should still evaluate non-HIPAA activities (for example, marketing vendors, websites, or apps) to ensure your vendors and configurations would comply if the carve‑out does not reach a particular use case. ([law.justia.com](https://law.justia.com/codes/connecticut/2024/title-42/chapter-743jj/section-42-526/?utm_source=openai))

Genetic Privacy Law Compliance

Direct-to-consumer genetic testing companies

Beginning October 1, 2026, Connecticut’s genetic privacy law establishes duties for direct‑to‑consumer genetic testing companies, including express consent, limits on use and disclosure, and clear consumer controls over genetic data and biological samples. Notably, the law excludes licensed health care professionals acting within scope who order testing for medical purposes—so most clinical pathology workflows are out of scope, while any separate direct-to-consumer line would be in scope. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf?utm_source=openai))

Exemptions and Applicability

Entity- and data-level carve-outs most relevant to labs

• HIPAA covered entities and business associates are exempt from the CTDPA at the entity level. ([portal.ct.gov](https://portal.ct.gov/AG/Sections/Privacy-/The-Connecticut-Data-Privacy-Act?trk=article-ssr-frontend-pulse_little-text-block))
• Multiple data categories are exempt regardless of entity, including protected health information under HIPAA, certain research data, and HIPAA-de‑identified information. ([codes.findlaw.com](https://codes.findlaw.com/ct/title-42-business-selling-trading-and-collection-practices/ct-gen-st-sect-42-517/?utm_source=openai))
• The consumer health data restrictions also exempt HIPAA covered entities and business associates. ([law.justia.com](https://law.justia.com/codes/connecticut/2024/title-42/chapter-743jj/section-42-526/?utm_source=openai))

If you operate separate business lines beyond HIPAA-covered services (e.g., non-clinical direct-to-consumer offerings), assess those activities independently against the CTDPA coverage thresholds and duties. ([portal.ct.gov](https://portal.ct.gov/AG/Sections/Privacy-/The-Connecticut-Data-Privacy-Act?trk=article-ssr-frontend-pulse_little-text-block))

Data Controller Obligations

Core CTDPA duties (when the law applies)

• Publish a concise, clear privacy notice describing categories of personal data, purposes of processing, sharing practices, and how consumers can exercise their rights and opt-outs (including honoring universal opt-out signals). ([portal.ct.gov](https://portal.ct.gov/AG/Sections/Privacy-/The-Connecticut-Data-Privacy-Act?trk=article-ssr-frontend-pulse_little-text-block))
• Adopt data minimization and purpose‑limitation practices; obtain consent for sensitive data. ([portal.ct.gov](https://portal.ct.gov/AG/Sections/Privacy-/The-Connecticut-Data-Privacy-Act?trk=article-ssr-frontend-pulse_little-text-block))
• Conduct data protection assessments (impact assessments) for heightened‑risk processing such as targeted advertising, sales, sensitive data, and certain profiling. ([prdext3.cga.ct.gov](https://prdext3.cga.ct.gov/current/pub/chap_743jj.htm?utm_source=openai))
• Maintain security safeguards proportionate to data volume and sensitivity. ([portal.ct.gov](https://portal.ct.gov/AG/Sections/Privacy-/The-Connecticut-Data-Privacy-Act?trk=article-ssr-frontend-pulse_little-text-block))

De-identified data requirements

If you use de‑identified data, you must take reasonable measures to prevent reidentification, publicly commit to process it only in de‑identified form and not attempt to reidentify it, and contractually require recipients to do the same. These de‑identified data requirements apply independently from HIPAA’s de‑identification standard. ([cga.ct.gov](https://www.cga.ct.gov/2026/sup/chap_743jj.htm?utm_source=openai))

Processor management

When you engage vendors as processors (e.g., billing, IT, or analytics providers), you must have written contracts that describe processing instructions, confidentiality, security, subprocessor controls, and audit‑support obligations. For consumer health data processing, ensure the contract meets CTDPA’s processor requirements before granting access. ([portal.ct.gov](https://portal.ct.gov/AG/Sections/Privacy-/The-Connecticut-Data-Privacy-Act?trk=article-ssr-frontend-pulse_little-text-block))

Enforcement and Penalties

Who enforces and what to expect

The Connecticut Attorney General has exclusive authority to enforce the CTDPA; there is no private right of action. Violations are treated as unfair trade practices under CUTPA, which authorizes civil penalties up to $5,000 per violation, along with injunctive relief, restitution, and disgorgement. ([portal.ct.gov](https://portal.ct.gov/AG/Sections/Privacy-/The-Connecticut-Data-Privacy-Act?trk=article-ssr-frontend-pulse_little-text-block))

Cure period timeline

From July 1, 2023 through December 31, 2024, the Attorney General was required to offer a 60‑day opportunity to cure certain violations before bringing an action. As of January 1, 2025, the decision to offer a cure is discretionary and depends on factors such as the number of violations, the controller’s size and complexity, and risk of harm. ([cga.ct.gov](https://www.cga.ct.gov/2023/pub/chap_743jj.htm?utm_source=openai))

Best Practices for Independent Pathology Practices

Action checklist you can implement now

• Map your data: distinguish PHI, HIPAA‑de‑identified data, and any non‑HIPAA personal data (e.g., website and marketing). Then confirm whether CTDPA applies to any line of business not covered by HIPAA exemptions. ([codes.findlaw.com](https://codes.findlaw.com/ct/title-42-business-selling-trading-and-collection-practices/ct-gen-st-sect-42-517/?utm_source=openai))
• Harden your website: inventory third‑party tags and SDKs; avoid geofencing or location‑based outreach around reproductive or mental health facilities; document opt‑out signal handling if CTDPA applies. ([codes.findlaw.com](https://codes.findlaw.com/ct/title-42-business-selling-trading-and-collection-practices/ct-gen-st-sect-42-526/?utm_source=openai))
• Tune vendor contracts: ensure HIPAA business associate agreements remain current; for any CTDPA‑covered processing, add processor terms mirroring CTDPA requirements, including confidentiality and subprocessor controls. ([portal.ct.gov](https://portal.ct.gov/AG/Sections/Privacy-/The-Connecticut-Data-Privacy-Act?trk=article-ssr-frontend-pulse_little-text-block))
• Apply de‑identification rigor: follow both HIPAA and CTDPA de‑identification and de‑identified data handling commitments if you share data for research, quality programs, or analytics. ([cga.ct.gov](https://www.cga.ct.gov/2026/sup/chap_743jj.htm?utm_source=openai))
• Assess higher‑risk processing: complete data protection assessments before embarking on targeted advertising, sensitive data processing, consumer profiling, or data sales in any non‑HIPAA business line. ([prdext3.cga.ct.gov](https://prdext3.cga.ct.gov/current/pub/chap_743jj.htm?utm_source=openai))
• Prepare for the genetic privacy law: if you plan any direct‑to‑consumer genetic services, build express‑consent flows, consumer controls, retention/deletion rules, and breach response specific to genetic data before October 1, 2026. ([prdext2.cga.ct.gov](https://prdext2.cga.ct.gov/2026/act/pa/pdf/2026PA-00064-R00SB-00004-PA.pdf?utm_source=openai))

Conclusion

For most independent pathology practices operating as HIPAA‑covered entities, Connecticut’s entity‑level exemptions mean that CTDPA’s core obligations and the consumer health data restrictions generally do not apply. Still, you should verify any non‑HIPAA activities, strengthen vendor contracts and de‑identified data practices, honor universal opt‑outs if CTDPA applies to any line of business, and prepare now if you intend to offer direct‑to‑consumer genetic services under the new genetic privacy law. ([portal.ct.gov](https://portal.ct.gov/AG/Sections/Privacy-/The-Connecticut-Data-Privacy-Act?trk=article-ssr-frontend-pulse_little-text-block))

FAQs

What data privacy rights do Connecticut residents have under CTDPA?

Residents can access, correct, delete, and obtain a portable copy of their personal data, and they can opt out of the sale of personal data, targeted advertising, and certain profiling. They can also request a list of third parties to whom their data was sold and send a universal opt‑out signal that covered controllers must honor.

How does CTDPA affect independent pathology practices?

Most independent pathology groups qualify as HIPAA covered entities, which are exempt from CTDPA at the entity level. That means CTDPA’s main “data controller obligations” typically do not apply to your clinical operations. Reassess any separate, non‑HIPAA activities (for example, a direct‑to‑consumer offering or a non‑clinical affiliate) to determine CTDPA coverage and duties.

What are the obligations regarding consumer health data?

Absent an exemption, you must: keep employee/contractor access confidential, use processor contracts before granting access, obtain consent before selling consumer health data, and avoid geofencing around mental health or reproductive/sexual health facilities for data collection or targeting. HIPAA covered entities and business associates are exempt from these consumer health data restrictions.

When does the genetic privacy law become effective?

October 1, 2026. It primarily covers direct‑to‑consumer genetic testing companies, not licensed health care providers ordering tests for medical purposes. If you plan a consumer‑initiated genetic service, build compliant consent, controls, and retention/deletion processes before that date.