On April 17, 2023, the Washington State Legislature passed the “My Health My Data Act” (WMHMDA), which will take effect for most companies March 31, 2024. Unlike other modern state privacy laws that purport to regulate any collection of “personal data,” WMHMDA confers privacy protections only upon “Consumer Health Data.” This term is defined to include any data that is linked (or linkable) to an individual and that identifies their “past, present, or future physical or mental health status.”¹ As the statute is not intended to apply to HIPAA-regulated entities or employers,² it has caused some confusion regarding its scope (i.e., which companies may be collecting consumer health data) as well as its requirements. Specifically the Act refers to data that might “identify” a consumer seeking a service to “improve, or learn about a person’s mental or physical health” as an example of Consumer Health Data.³ As a result, organizations that traditionally don’t consider themselves to be collecting health data, such as grocery stores, newspapers, dietary supplements providers, and even fitness clubs, are uncertain whether the Act may be interpreted to apply to them to the extent that someone seeks out such companies either for information about health or to improve their health.

Among other things, organizations subject to the WMHMDA are required to obtain consent for a variety of processing activities that relate to Consumer Health Data. The following chart identifies processing activities that require consent. Click on the chart to view larger.

* Greenberg Traurig is not licensed to practice law in Washington and does not advise on Washington law. Specific Washington law questions and Washington legal compliance issues will be referred to lawyers licensed to practice law in Washington.

FOOTNOTES

1 Sub. House Bill 1155, § 3(8)(a) (2023).

2 Sub. House Bill 1155, § 3(7) (excluding from the definition of “consumer” an individual acting in an employment context), § 12(1)(a)(i) (excluding HIPAA regulated entities).

3 Sub. House Bill 1155, §§ 3(8)(a), 15 (2023).

4 Sub. House Bill 1155, § 5(1)(a)(ii) (2023).

5 Sub. House Bill 1155, § 5(1)(a)(i) (2023).

6 Sub. House Bill 1155, § 4(1)(c) (2023).

7 Sub. House Bill 1155, § 4(1)(c), (d) (2023).

8 Sub. House Bill 1155, § 5(1)(b)(ii) (2023).

9 Sub. House Bill 1155, § 7(a) (2023).

10 Sub. House Bill 1155, § 7(a) (2023). Further note that the statute expressly excludes from its definition of “Sharing” the transfer of personal information to a processor. Sub. House Bill 155, § 3(26)(b) (2023).

11 Sub. House Bill 1155, § 7(a) (2023).

12 Sub. House Bill 1155, § 7(a) (2023) (excluding corporate transitions from the definition of “share”).

13 Sub. House Bill 1155, § 4(1)(c), (d) (indicating that consent is needed for sharing that is not described in the privacy notice), § 5(1)(b)(i) (indicating that consent is needed if the sharing is not necessary to provide a product or service) (2023).

14 Note that the statute adopts a broad definition of “sale” which includes both transfers for money and transfers for other valuable consideration.

15 Sub. House Bill 1155, § 9(1) (2023).