The policy provides access, correction, deletion, and data sale opt-out rights to residents of approximately nineteen named states, subject to the HIPAA carve-out described elsewhere in the policy. Requests may be submitted online or by phone at 1-855-672-2755, and denied requests may be appealed to the company and then to the relevant state Attorney General.
This analysis describes what Oscar Health's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision operationalizes state consumer privacy rights for residents of approximately nineteen states and establishes a two-step appeal process, first to Oscar and then to the state Attorney General, for denied requests; the HIPAA carve-out applies as a limitation on the scope of these rights for health-related data.
Residents of the approximately nineteen named states may submit requests to access, correct, or delete their personal information, and to opt out of data sales or sharing, subject to HIPAA exceptions. Under this provision, Oscar states it will not discriminate against consumers for exercising privacy rights, though it reserves the right to charge a reasonable fee for compliance with requests to the extent permitted by applicable law.
Cross-platform context
See how other platforms handle State-Specific Consumer Privacy Rights and similar clauses.
Compare across platforms →"This Section is provided specifically for residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. In addition to the disclosures and rights provided above in this Notice, you may be entitled to exercise certain requests regarding your Personal Information as described below, subject as noted above to some exceptions that apply to us as a HIPAA-regulated organization and/or in regard to HIPAA-covered information.Excerpt from Oscar Health's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly implements requirements under CCPA, CPRA, and the analogous statutes in the approximately eighteen additional named states.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision operationalizes state consumer privacy rights for residents of approximately nineteen states and establishes a two-step appeal process, first to Oscar and then to the state Attorney General, for denied requests; the HIPAA carve-out applies as a limitation on the scope of these rights for health-related data.
Residents of the approximately nineteen named states may submit requests to access, correct, or delete their personal information, and to opt out of data sales or sharing, subject to HIPAA exceptions. Under this provision, Oscar states it will not discriminate against consumers for exercising privacy rights, though it reserves the right to charge a reasonable fee for compliance with requests …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Oscar Health.