Connecticut Data Privacy Act (CTDPA, Public Act 22-15)
Connecticut comprehensive consumer data privacy law with consumer rights, controller/processor obligations, and an AG enforcement framework — with substantial healthcare carve-outs.
Primary source
Connecticut Public Act 22-15 — CTGA →https://www.cga.ct.gov/2022/act/pa/pdf/2022PA-00015-R00SB-00006-PA.pdf
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
The Connecticut Data Privacy Act (CTDPA) — Public Act 22-15, effective July 1, 2023 — is Connecticut's comprehensive consumer data privacy law.
Applicability: persons that conduct business in CT or produce products/services targeted to CT residents and that, during the preceding year, controlled or processed personal data of 100,000+ consumers (excluding payment-only processing) or controlled/processed personal data of 25,000+ consumers while deriving more than 25% of gross revenue from the sale of personal data.
Consumer rights: access, correct, delete, opt-out (targeted advertising, sale, profiling for significant decisions), data portability.
Controller obligations: transparency (privacy notice), data minimization, purpose limitation, reasonable security, data protection assessments for high-risk processing, contracts with processors, sensitive-data opt-in consent.
Healthcare carve-outs: PHI under HIPAA is excluded; identifiable private information collected for research; deidentified data; information used in connection with an OHCA or similar arrangement. The exclusions are entity-level for HIPAA covered entities and business associates and data-level for PHI — but consumer data of a healthcare entity that is not PHI may still fall within CTDPA.
Enforcement: AG civil enforcement with 60-day cure period (sunset after Dec 31, 2024). No private right of action.
CT-based dental, mental health, and ancillary providers should map the carve-outs carefully — much of their data is outside HIPAA but inside CTDPA.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationCalifornia Confidentiality of Medical Information Act (CMIA, Cal. Civ. Code 56-56.37)California state law providing broader patient confidentiality protections than HIPAA for medical information held by providers, contractors, and certain employers.
- RegulationColorado Privacy Act (CPA, C.R.S. § 6-1-1301 et seq.)Colorado comprehensive consumer privacy law with consumer rights, controller/processor obligations, universal opt-out mechanism requirement, and an AG enforcement framework with HIPAA carve-outs.
- RegulationHIPAA Privacy Rule: General Rules for Uses and Disclosures (45 CFR 164.502)The general rules covered entities follow for any use or disclosure of protected health information, including the minimum necessary standard and treatment, payment, and operations exceptions.
- StateAlaska healthcare compliance overlayAlaska has no state-specific medical-information privacy statute beyond HIPAA, and no health-data-only breach rule.
- StateAlabama healthcare compliance overlayAlabama was the last U.
- StateArkansas healthcare compliance overlayArkansas's Personal Information Protection Act adds 'medical information' to the categories triggering breach notification but does not impose health-information-specific privacy rules beyond HIPAA.
- StateArizona healthcare compliance overlayArizona broadened its breach statute in 2018 to add medical information, health insurance identifiers, biometric data, and online credentials.
- ComplianceCalifornia Healthcare Compliance: CMIA + HIPAA — Where They DivergeCalifornia's CMIA (Civ. Code §§ 56–56.37) vs HIPAA: stricter consent, 5-working-day inspection / 15-day copy access, private right of action, up to $25k per knowing-and-willful violation + misdemeanor exposure.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.