Washington State Expands Privacy Protections For Health Data

On April 27, 2023, Washington Governor Jay Inslee signed the My Health My Data Act (the "Act") into law, establishing new limits on the collection, use and sharing of "consumer health data" and creating numerous compliance obligations for entities that are in scope. The Act will take effect on July 23, 2023 and specifies that compliance is mandated for most sections by March 31, 2024 generally and June 30, 2024 for small businesses. However, the Act's prohibitions on geofencing appear to take effect on July 23, 2023. Below, we have provided a summary of key aspects of the Act and outlined some steps potentially impacted entities may want to take.

Scope of the Act

The Act protects Washington residents and other natural persons whose "consumer health data" is collected in Washington, and specifies that "consumers" are natural persons acting in the individual or household context, however identified, including any unique identifiers, and does not include