WA passes My Health, My Data Act

On April 27, 2023 Washington state Governor Jay Inslee signed My Health, My Data Act into law. This sweeping legislation impacts all Washington-based companies along with any entities that have health data for Washington citizens. The Act protects not only Washington citizens, but also anyone whose health data is collected in Washington. The MHMD act applies to consumer health information that is not covered by HIPAA.

In addition to prohibiting the sale of health data, the act also requires disclosure of data collection and sharing. Consumers will be authorized to request their health data deleted and geofences around facilities that provide in-person healthcare will be banned.

The MHMD Act broadens the definition of consumer health data. This includes but is not limited to:

• Individual health conditions, treatment, status, diseases, or diagnoses
• Social, psychological, behavioral, and medical interventions
• Health-related surgeries or procedures
• Use or purchase of medication
• Bodily functions, vital signs, symptoms, or measurements of the information described in this subsection
• Diagnoses or diagnostic testing, treatment, or medication
• Gender-affirming care information
• Reproductive or sexual health information
• Biometric data
• Genetic data
• Precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies and
• Any information in the above categories that is derived or extrapolated from non-health information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning).

Companies will have until March 31, 2024 to comply with this new law.