Is Your Business Ready For Washington's New Data Privacy Statute?

Major Portions Go Into Effect March 31, 2024, Including Its Private Right of Action

Washington's "My Health, My Data Act" is a new data privacy statute that regulates the collection, sharing, selling, and processing of "consumer health data" by certain entities. The act is intended to protect health data not otherwise protected by federal health care privacy regulations, such as entities not regulated by HIPAA. Despite its name, the act broadly encompasses the regulation of personal data beyond traditional health care data. In certain circumstances, it regulates the collection of non-Washington residents' data and businesses outside of Washington. "Regulated entities," as defined by the act, must comply with its obligations beginning March 31, 2024, while "small businesses" have until June 30, 2024. The act will have wide-reaching ramifications for businesses due to the expansive scope of the act's coverage and enforcement through a private right of action.