SENATE COMMERCE COMMITTEE

STATEMENT TO

[Second Reprint]

ASSEMBLY, No. 5017

with committee amendments

STATE OF NEW JERSEY

DATED:  NOVEMBER 17, 2025

      The Senate Commerce Committee reports favorably and with committee amendments Assembly Bill No. 5017 (2R).

      This bill exempts insurance-support organizations and national securities associations from the provisions of current law that require certain entities to notify consumers of collection and disclosure of personal data.  Under current law, insurance institutions and other entities are exempt from those requirements.

      As amended, the bill exempts certain data from disclosure requirements under current law, including:

      (1) information treated like protected health information collected, used, or disclosed by a covered entity or business associate under the "Health Insurance Portability and Accountability Act of 1996" (HIPAA), when the information is used or disclosed in accordance with HIPAA and the information is afforded all the privacy protections and security safeguards of the federal laws and implementing regulations under HIPAA; and

      (2) human subjects research conducted in accordance with good clinical practice guidelines issued by The International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use.

      Finally, as amended, the bill expands the definition of de-identified data under current law to include data de-identified in accordance with the requirements in HIPAA, where any recipients of that data are contractually prohibited from attempting to reidentify the data.

      As amended and reported by the committee, Assembly Bill No. 5017 (2R) is identical to Senate Bill No. 4259, which was also amended and reported by the committee on this date.

COMMITTEE AMENDMENTS:

      The committee amended the bill to:

      (1)  exempt certain data from disclosure requirements under current law, including:

      (a) information treated like protected health information collected, used, or disclosed by a covered entity or business associate under HIPAA, when the information is used or disclosed in accordance with HIPAA and the information is afforded all the privacy protections and security safeguards of the federal laws and implementing regulations under HIPAA; and

      (b) human subjects research conducted in accordance with good clinical practice guidelines issued by The International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use; and

      (2) expand the definition of de-identified data under current law to include data de-identified in accordance with the requirements in HIPAA, where any recipients of that data are contractually prohibited from attempting to reidentify the data.