Consumer Health Data Privacy Policy
This section of the NBME Privacy Notice is our Consumer Health Data Privacy Policy (“CHD Privacy Policy”) which describes how NBME (“we”, “us”, “our”) collect and process the “consumer health data” of residents (“you”, “your”) in Connecticut, Nevada, and Washington, respectively, under the Connecticut consumer health data amendments, Nevada consumer health data law, and the Washington My Health My Data Act (collectively, we refer to these laws as “CHD Laws”).
1. Consumer Health Data Collection
NBME may collect “consumer health data” as defined under the CHD Laws.
We may collect the following information:
- Medical information: including information about present or past injuries, conditions, tests, measurements, diagnoses, bodily function, vital sign, symptoms, physical or mental health status, or reproductive or sexual health information; for example, information in a medical record or photographs submitted to support applications for test accommodations.
- Biometric information: including data generated during fingerprinting that is collected from you to enable the use of our Services.
- Patient visit information: including health-related information shared or generated during patient visits with healthcare providers or information identifying individuals seeking healthcare services. Also, administrative information about patient visits, such as date, time, attending physician, and location of the visit.
- Treatment, medication, or prescription information: including treatment plans, surgeries and procedures, or other physical or mental health interventions.
- Other consumer health information that you provide to us on a voluntary basis.
2. Sources of Consumer Health Data
NBME may collect categories of consumer health data from consumers like you in a few different ways, including:
- Information you provide directly to us: including when you use our NBME’s examination services (“Services”), request accommodations, participate in a pilot program, attend NBME programs or events, engage with customer service on phone calls and any other way that you may be able to interact with us. With your permission, we may also collect consumer health data from other sources that are provided by you like your connected device.
- Information from third parties: including, but not limited to, third-party service providers, business partners, treatment providers, educational institutions, legal counsel representing you, industry and patient groups and associations you participate in and provide permission for disclosing to us consumer health data. We may also combine information we have collected from multiple sources. We sometimes work with these other organizations to provide you with our Services.
- Information from NBME platforms: including from our websites, and user accounts.
3. Our Purposes
NBME may collect and use consumer health data described above to the extent necessary to provide Services requested by a Connecticut, Nevada or Washington consumer or with the consumer’s consent, such as providing educational information or reviewing examinees’ requests for accommodations.
We may also use this data for other business and commercial purposes, as further described in the “Use of Information Collected” section of the NBME Privacy Notice, including, but not limited to:
- Fulfill your requests, orders, or transactions related to the Services, including customer support;
- Support your use of NBME products and services;
- Manage and send transactional communications;
- Use for scientific research purposes;
- Oversee the business development of the Services and research insights to understand how people use the Services; and
- Prevent, detect, protect against, and respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any activity that is illegal under Washington state or federal law; comply with law; and preserve the integrity and security of our systems; and investigate, report, or prosecute those responsible for any illegal action under Washington state or federal law;
- Use for internal operations, data analysis, audits, product development, enhancing our Services, identifying usage trends, determining the effectiveness of our communications and solutions, and aggregated research.
4. Recipients of Consumer Health Data
We may provide consumer health data to our service providers to provide the Services you have requested. In addition, NBME may share the categories listed above in the “Sources of Consumer Health Data” section of this CHD Privacy Policy. NBME may also disclose or transfer consumer health data to contractors to provide Services in a manner consistent with the purpose for which the consumer health data was collected and disclosed.
We do not “sell” consumer health data, as that term is defined by the CHD Laws.
5. Consumer Health Data Rights
The CHD Laws provides certain rights with respect to consumer health data we collect. If you are a resident of Connecticut, Nevada, or Washington, you may choose to exercise the following rights regarding consumer health data we collect about you, subject to certain exceptions and limitations.
- The right to confirm whether we are collecting, sharing, or selling consumer health data about you. As described above, NBME discloses consumer health data to provide Services you have requested. NBME does not “sell” consumer health data, as that term is defined by the CHD Laws.
- The right to access consumer health data we collected about you. If you are a Nevada resident, you also have the right to access a list of all third-party recipients of consumer health data about you.
- The right to request that we delete the consumer health data we collected about you.
- If you are a Nevada resident, the right to request we cease collecting or sharing consumer health data about you. Please note that if you cease our collection or sharing of consumer health data, we may be unable to provide you with some services.
- The right not to receive discriminatory treatment for the exercise of the above consumer health rights.
- The right to withdraw consent to our collection and sharing of consumer health data collected about you.
To exercise these rights, please email us at Privacy@nbme.org with “Consumer Health Data Rights Request” in the subject line.
Any privacy rights request you submit to us is subject to a verification process. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify you are the consumer about whom we collected consumer health data. Please follow the instructions we provide you and promptly respond to any follow-up inquires so that we may confirm your identity.
If you have submitted a consumer health data rights request that we have not reasonably fulfilled, you may appeal that decision by submitting a request to Privacy@nbme.org and noting “Notice of Appeal” in the subject line. We will process and respond to your appeal within the time permitted by the CHD Laws.
6. Contact Us
If you have other questions about your consumer health data, please contact us by emailing us at Privacy@nbme.org or by clicking on the “Contact Us” link on the NBME website and select “Data Privacy” from the “Choose your topic” dropdown menu. Alternatively, you may send a letter to the following address:
National Board of Medical Examiners
Attention: Legal Services Department
3750 Market Street
Philadelphia, PA 19104
In all communications to NBME, please include the email address used for exam registration (if applicable), the website address or the specific NBME program to which you provided Consumer Health Data and a detailed explanation of your request. We will do our best to respond to all reasonable requests in a timely manner.
NBME reserves the right to amend this Consumer Health Data Privacy Policy at any time. If NBME changes its privacy practices, a new Consumer Health Data Privacy Policy will reflect those changes and the effective date of the revised Consumer Health Privacy Policy will be set forth at the top of this section.