Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy provides access, correction, deletion, and data sale opt-out rights to residents of approximately nineteen named states, subject to the HIPAA carve-out described elsewhere in the policy. Requests may be submitted online or by phone at 1-855-672-2755, and denied requests may be appealed to the company and then to the relevant state Attorney General.
This analysis describes what Oscar Health's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision operationalizes state consumer privacy rights for residents of approximately nineteen states and establishes a two-step appeal process, first to Oscar and then to the state Attorney General, for denied requests; the HIPAA carve-out applies as a limitation on the scope of these rights for health-related data.
Residents of the approximately nineteen named states may submit requests to access, correct, or delete their personal information, and to opt out of data sales or sharing, subject to HIPAA exceptions. Under this provision, Oscar states it will not discriminate against consumers for exercising privacy rights, though it reserves the right to charge a reasonable fee for compliance with requests to the extent permitted by applicable law.
Cross-platform context
See how other platforms handle State-Specific Consumer Privacy Rights and similar clauses.
Compare across platforms →Monitoring
Oscar Health has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"This Section is provided specifically for residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. In addition to the disclosures and rights provided above in this Notice, you may be entitled to exercise certain requests regarding your Personal Information as described below, subject as noted above to some exceptions that apply to us as a HIPAA-regulated organization and/or in regard to HIPAA-covered information.Excerpt from Oscar Health's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly implements requirements under CCPA, CPRA, and the analogous statutes in the approximately eighteen additional named states. Each statute has its own specific requirements for request processing timelines, verification procedures, and response obligations; the policy states requests will be processed within the timeframe prescribed by applicable privacy law. State attorneys general in all named states have enforcement authority. 2) GOVERNANCE EXPOSURE: Medium. The policy's reservation of the right to charge a reasonable fee for privacy rights requests may be evaluated against state law standards, as some states limit or prohibit fees for consumer privacy rights requests. The declaration under penalty of perjury requirement for specific piece requests is consistent with CCPA; compliance teams should verify this requirement is applied consistently and documented. 3) JURISDICTION FLAGS: California, Colorado, Connecticut, and Virginia have the most active enforcement of consumer privacy rights request obligations. The policy's statement that it may charge a reasonable fee should be reviewed against the specific fee provisions, if any, in each named state's statute. States added to the list in this policy version should be confirmed against effective dates of their respective statutes. 4) CONTRACT AND VENDOR IMPLICATIONS: Service provider contracts should include obligations for vendors to assist with consumer privacy rights requests, particularly deletion requests, within the timeframes required by applicable law. The policy states deletion requests result in permanent account termination, which is an operational workflow that should be documented and tested. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should maintain documented request intake, verification, and response workflows for each named state, accounting for differences in processing timelines and scope. The appeal process described in the policy should be operationally implemented with documented response timelines. The fee reservation should be reviewed against state law to confirm it is only applied where permitted.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision operationalizes state consumer privacy rights for residents of approximately nineteen states and establishes a two-step appeal process, first to Oscar and then to the state Attorney General, for denied requests; the HIPAA carve-out applies as a limitation on the scope of these rights for health-related data.
Residents of the approximately nineteen named states may submit requests to access, correct, or delete their personal information, and to opt out of data sales or sharing, subject to HIPAA exceptions. Under this provision, Oscar states it will not discriminate against consumers for exercising privacy rights, though it reserves the right to charge a reasonable fee for compliance with requests …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Oscar Health.