Vermont Data Privacy and Online Surveillance Act 2415k-1: 9 V.S.A. § 2415k(1) and (2) Consumer health data only to staff under a confidentiality duty and to processors under contract

A person must not give an employee or contractor access to consumer health data unless they are under a contractual or statutory duty of confidentiality, nor give a processor access unless the person and processor comply with section 2415f.