Washington Is First State To Pass Consumer Health Data Privacy Law

Washington is the first state to enact a comprehensive consumer privacy law focused on health data. House Bill 1155, also known as the My Health My Data Act, was signed into law by Gov. Jay Inslee on April 27, 2023. The Act will take effect on March 31, 2024, with certain small businesses granted an extension until June 30, 2024, and will add significant compliance obligations to the patchwork of state data privacy laws.

Unlike the existing patchwork, the Act focuses exclusively on consumer health data that is not regulated by the Health Insurance Portability and Accountability Act (HIPAA). While health care providers and similar HIPAA-covered entities are exempt, many advertisers, mobile app providers, wearable device manufacturers and health care companies and their data processors outside the scope of HIPAA may be materially impacted.