Washington's Biometric Data Regime Advances Privacy Regulation

On April 27, Washington Governor Jay Inslee signed into law the state's expansive health privacy law, the My Health My Data Act. Effective March 31, 2024, the MHMDA establishes a comprehensive privacy framework for entities doing business in Washington state that handle consumer health data.

Reflecting a trend by lawmakers to safeguard health-related data not historically protected by laws such as HIPAA, the act was designed to "close an egregious legal loophole that allows non-health care organizations to collect, share or sell private health information."

The law defines "consumer health data" broadly to include any personal information reasonably linkable to a consumer and identifies the consumer's past, present, or future physical or mental-health status. Chief among the categories of information under this definition is biometric data, positioning the MHMDA as a de facto biometric information privacy law that imposes obligations beyond Washington's existing