On April 17, 2023, the Washington State House concurred to the Washington State Senate’s amendments to Washington State House Bill 1155, the My Health My Data Act (the “Act”), clearing the Act’s way to Governor Jay Inslee for a final signature. If enacted, the Act would be the first comprehensive consumer health information privacy law in the United States.

Specifically, the Act would apply to any legal entity that (1) conducts business in Washington state or offers products or services targeted at consumers in the state, and (2) determines the purpose and means of collecting, processing, sharing, or selling of consumer health data. The Act would require covered entities to obtain the consent of Washington consumers before collecting or sharing the consumers’ health data. In addition, the Act would require covered entities to maintain a detailed consumer health data policy, and set up a geofence around facilities providing in-person health care. 

The Act would grant consumers the right to access the health data the regulated entity collected, shared or sold about them. Consumers would also have the right to delete information that concerns them, and withdraw consent for the covered entity’s collection or sharing of the consumer’s health data. 

The Act would be enforceable by the Washington Attorney General and via a private right of action under Washington’s Consumer Protection Act. The Act’s proposed effective date is March 31, 2024.