Wash. Governor Signs Personal Health Data Protection Bill
Washington Gov. Jay Inslee has signed House Bill 1155, the WA My Health, My Data Act, which aims to protect the personal health data of all Washingtonians.
A news release on the website of Rep. Vandana Slatter, D-Bellevue, who introduced the bill, noted that it also protects the health data of individuals who visit Washington seeking healthcare such as reproductive and gender-affirming services.
Stating that websites, apps, and health-tracking devices currently lack basic data privacy protections, proponents say House Bill 1155 will modernize Washington’s consumer protection framework to better regulate collection, sharing, and sale of private health data.
The release also says that the bill is important in light of the fact that neighboring states have passed regressive policies and the U.S. Supreme Court announced a major reversal of the Roe decision.
“As a mother and a pharmacist, I recognize the importance of protecting our health data and access to comprehensive healthcare,” Rep. Slatter said in a statement. “As a woman and a legislator, I am honored to have sponsored the My Health, My Data Act in the House to protect all Washingtonians health and data privacy in Washington state, including reproductive and gender affirming care.”
In its enacted form, House Bill 1155 guarantees Washingtonians:
- the right to withdraw consent and request data deletion
- restricts geo-fencing around healthcare facilities
- prohibits collection and sharing of health data without consent
- requires entities that collect this data to provide consumers with a privacy policy disclosing the use of health data
“Without a federal policy, this is where we are and the first-in-the-nation bill we need,” added Rep. Slatter. “I’m grateful to my colleagues and the attorney general for choosing to rise to the occasion in protecting people’s right to privacy, personal agency and safe medical care.”
Enforcement mechanism for violations of HB 1155 provide the Attorney General’s Office the ability to investigate violations and pursue litigation. Additionally, Washingtonians may bring civil lawsuits through a private right of action.
“This law provides Washingtonians control over their personal health data,” Attorney General Bob Ferguson said in a statement. “Washingtonians deserve the right to decide who shares and sells their health data, and the freedom to demand that corporations delete their sensitive health data — and will now have these protections.”
House Bill 1155 provides requirements to obtain consent in order to collect, share, or sell consumer health data, to respond to requests to exercise a consumer right, and to meet specified obligations for regulated entities by March 31, 2024, and June 30, 2024, for small businesses.
