Lexology May 4, 2023
Last week, Washington State passed a novel health privacy law titled the “My Health My Data Act.” The Act, which will come into effect on March 31, 2024, provides protections for consumer health data that is collected by businesses not expressly covered by the Health Information Portability and Accountability Act of 1996 (HIPAA). Essentially, The Act is intended to serve as a supplement to HIPAA to apply to more entities, but it goes much farther than that. The Act borrows concepts from HIPAA, state consumer privacy laws, and biometric privacy laws, such as Illinois’ Biometric Information Privacy Act, to create the most restrictive state regulation of consumer health and biometric information to date. Importantly, the law includes a robust private...