• Telehealth

Washington State Leads the Way in Health Data Protection

April 23, 2023

Washington State has recently passed a pioneering law, known as the My Health, My Data Act, designed to protect consumer health data and regulate its collection and use, focusing on technology companies and advertisers. 

 

This legislation, signed by Governor Jay Inslee, mandates that companies obtain explicit and unambiguous consent before gathering health-related information, ranging from medical conditions to location data associated with healthcare services. 

 

The majority of the law will come into effect in March 2024, signaling a potential reset in privacy discussions at the state level.

 

Addressing Privacy Concerns in an Evolving Landscape:

 

As data collection and privacy with

 digital advertising concerns continue to mount, state and federal lawmakers have shown an increasing interest in implementing privacy laws. Factors such as the Supreme Court’s recent decision on Roe V. Wade have contributed to the urgency in safeguarding personal health data. Washington State Representative Vandana Slatter, the bill’s sponsor, highlighted the need for protecting individuals accessing reproductive care, gender-affirming care, and other healthcare services. 

 

The law aims to bridge gaps in existing federal privacy regulations, particularly the Health Insurance Portability and Accountability Act (HIPAA), enacted before the advent of smartphones and comprehensive digital data collection.

 

Key Provisions and Consent Requirements:

 

The Washington State law seeks to address data collection by non-covered entities, such as search history and certain health apps, which often supply personal information to data brokers and technology companies for targeted advertising. 

 

The legislation explicitly references ad-tech tools like third-party cookies, IP addresses, and device IDs. Companies wishing to collect or share health data must obtain consent through a “clear affirmative act” indicating a consumer’s voluntary, informed, and unambiguous agreement. 

 

For data sales, companies must outline the specific data being sold and secure the consumer’s signature. While the law provides guidelines for consent, it acknowledges that further operationalization details will be left to the entities.

 

Implications and Challenges:

 

The My Health, My Data Act encompasses a broad range of healthcare services, including proxy and inferred data derived from non-health-related information, raising questions about the scope of applicability. 

 

The law’s potential impact on online advertising and the data broker industry is expected to be significant. However, some privacy experts, such as Mike Hintze, a former chief privacy counsel at Microsoft, express concerns about the stringent requirements and detailed documentation involved in obtaining consent. 

 

Nevertheless, the law grants Washington residents the right to withdraw consent and request data deletion, while prohibiting companies from discriminating against individuals exercising their rights.

 

Influence and Future Outlook:

 

Washington State’s groundbreaking legislation may serve as a model for other states seeking to accelerate their own privacy laws. 

 

Similar bills have been introduced in states such as New York, Illinois, Massachusetts, and Nevada. As companies increasingly embrace privacy by design principles, incorporating the necessary adjustments to comply with the law is deemed manageable, albeit potentially disruptive to selling health data. 

 

With heightened awareness of data privacy and individual rights, the My Health, My Data Act signals a significant step toward protecting personal health information and shaping the future of privacy regulations.