Expands definition of covered entity in GS 90-414.3 to also include any other entity that engages in the practice of assembling, collecting, analyzing, using, evaluating, storing, or transmitting protected health information (PHI). Enacts new GS 90-414.6A (notice of data sale or transfer, exemption for clinical research involving human subjects), as follows. Prevents a covered entity from using or disclosing a patient’s PHI for any purpose outside of the normal course of providing patient care, billing or paying for healthcare services, or determining insurance coverage for healthcare services, unless the covered entity first send the patient a notice, electronically or in writing, which is separate from the notice of privacy practice contained in the HIPAA Privacy Rule, of the covered entity’s intent to distribute or sell the patient’s PHI and the patient agrees.  Sets forth criteria for notice. Specifies that the covered entity cannot make a patient's treatment, access to care, access to a patient portal, or coverage for care contingent on the patient's agreement to the terms of a notice of data sale or transfer. Exempts information of captured in the process of clinical research involving the participation of human subjects (defined term in the act). Effective January 1, 2024, and applies to acts occurring on or after that date.