EFFECT:  Provides that if a processor fails to adhere to the regulated entity's instructions or processes consumer health data in a manner that is outside the scope of the processor's contract with the regulated entity, the processor is considered a regulated entity with regard to such data specifically, rather than a regulated entity generally. Provides that, in that case, the processor is subject to the requirements of the bill with regard to such data specifically, rather than subject to the requirements of the bill generally.