[criddell]

I'm not 100% sure, but I think there are also data retention limits and opt-out requirements as part of that act. Some states have stricter rules as well.

[scarface74]

There is an opt out. The only retention policy is that records must be destroyed within one year after the account is terminated.

https://epic.org/privacy/vppa/