/>iOn April 27, 2023, Washington’s Governor signed Washington’s My Health, My Data Act (“WMHMDA” or “Act”). Starting March 31, 2024, most entities subject to the Act will have certain obligations towards consumer health data,[1] including providing consumers with the right to access their information, withdraw their consent to certain processing, and request the deletion of their information. While the Act was promoted as a measure to help protect reproductive and gender affirming care, whether intended or not, its scope goes beyond those discreet issues.*
What entities are regulated?
Under Section 3(23) of the WMHMDA, a Regulated entity is one that (a) conducts business in Washington or produces or provides products or services targeting consumers in Washington, and (b) “alone or jointly with others, determines the purpose and means of collecting, processing, sharing, or selling of consumer health data.” For a list of excepted entities or processing activities, please see GT’s previous blog post here.
What types of data are regulated?
Consumer health data as defined within the WMHMDA is broad and encompasses many potential processing activities. Moreover, the term health care services is incorporated within consumer health data, whereby if a regulated entity provides certain services, in addition the processing activities outlined in the definition of consumer health data, then those services are regulated by the WMHMDA.
Below is a chart that presents and summarizes the types of data that may be included within consumer health data.
| Data Types | Description of Processing Activity | Statutory Reference |
| 1. Information about mental or physical health status | The main definition of consumer health data is broad and includes any “personal information that is linked or reasonably linkable to a consumer” and “identifies that consumer’s past, present, or future physical or mental health status.” Personal information is likewise defined broadly under the WMHMDA as “information that identifies or reasonable capable of being associated or linked, directly, or indirectly, with a particular consumer.” As a result, any personal information of a consumer that is about any portion of that consumer’s mental or physical health is consumer health data and is regulated by the WMHMDA. | Section 3(8)(a), 3(18)(a) (providing the personal information definition) |
| 2. Information related to providing a health care service | Personal information related to providing a consumer with health care services is considered physical or mental health status and is regulated by the WMHMDA. In addition to services listed in 18-33 below, health care services are “any service[s] provided to a person to assess, measure, improve, or learn about a person’s mental or physical health.” | Section 3(8)(b)(xii), 3(15) |
| 3. Information on treatments or diagnosis | Personal information related to an individual’s health condition, treatment, diseases, or diagnosis of such items is considered physical or mental health status and is regulated by the WMHMDA. | Section 3(8)(b)(i), |
| 4. Information on medical interventions | Personal information related to an individual’s social, psychological, behavioral, or medical interventions is considered physical or mental health status and is regulated by the WMHMDA. | Section 3(8)(b)(ii) |
| 5. Information on surgeries or procedures | Personal information related to an individual’s surgery or procedure is considered physical or mental health status and is regulated by the WMHMDA. | Section 3(8)(b)(iii) |
| 6. Information on medication | Personal information related to an individual’s use or purchase of prescribed medication is considered physical or mental health status and is regulated by the WMHMDA. | Section 3(8)(b)(iv) |
| 7. Information on bodily functions | Personal information related to an individual’s bodily functions is considered physical or mental health status and is regulated by the WMHMDA. | Section 3(8)(b)(v) |
| 8. Information on vital signs | Personal information related to an individual’s vital signs is considered physical or mental health status and is regulated by the WMHMDA. | Section 3(8)(b)(v) |
| 9. Information on symptoms | Personal Information related to an individual’s symptoms is considered physical or mental health status and is regulated by the WMHMDA. | Section 3(8)(b)(v) |
| 10. Information on measurements of health information | Personal information related to an individual’s measurements of medical information described in this table is considered physical or mental health status and is regulated by the WMHMDA. | Section 3(8)(b)(v) |
| 11. Information on diagnostic testing | Personal information related to an individual’s diagnoses or diagnostic testing, treatment, or medication is considered physical or mental health status and is regulated by the WMHMDA. | Section 3(8)(b)(vi) |
| 12. Information on gender-affirming care | Personal information related to an individual’s use of gender-affirming care and associated information of such care is considered physical or mental health status and is regulated by the WMHMDA. “Gender affirming care information” is “personal information relating to seeking or obtaining past, present, or future, gender-affirming care services” and includes, but is not limited to, precise geolocation that could indicate a person is attempting to receive such services, efforts to research these services, or any gender-affirming care information that is derived, extrapolated or inferred from nonhealth information. | Sections 3(8)(b)(vii), 3(11)(a)-(c) (providing gender-affirming care definition) |
| 13. Information on reproductive health information | Personal information related to an individual’s reproductive or sexual health information is considered physical or mental health status and is regulated by the WMHMDA. “Reproductive or sexual health information” is any “personal information relating to seeking or obtaining past, present, or future reproductive or sexual health services” and includes, but not limited to precise geolocation that could indicate a person is attempting to receive such services, efforts to research these services, or any reproductive or sexual health information that is derived, extrapolated or inferred from nonhealth information. | Sections 3(8)(b)(viii), 3(24)(a)-(c) (providing reproductive health information definition) |
| 14. Biometric data | An individual’s biometric data is considered physical or mental health status and is regulated by the WMHMDA. “Biometric data” is any “data that is generated from the measurement or technological processing of an individual’s physiological, biological, or behavioral characteristics and that identifies a consumer, whether individually or in combination with other data.” Such data may include imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, voice patterns or recordings, and “keystroke patterns or rhythms and gain patterns or rhythms that contain identifying information.” | Sections 3(8)(b)(ix), 3(4) (a)(b) (providing the biometric data definition) |
| 15. Genetic data | An individual’s genetic data is considered physical or mental health status and is regulated by the WMHMDA. “Genetic data” is “any data, regardless of its format, that concerns a consumer’s genetic characteristics.” This may include raw sequencing or portions of DNA, genotypic and phenotypic information, and self-reported health data that a consumer submits to a regulated entity where such data is analyzed in connection with a consumer’s raw sequence data. | Sections 3(8)(b)(x), 3(13)(a)-(c) (providing genetic data definition) |
| 16. Precise locations | An individual’s precise location whereby it could reasonably indicate a consumer’s attempt to acquire or receive health services or supplies is considered physical or mental health status and is regulated by the WMHMDA. Precise location is information derived from technology that locates an individual within a radius of 1,750 feet. | Sections 3(8)(b)(xi), 3(19) (providing precise location information definition) |
| 17. Information derived from nonhealth information. | Processing related to any information “that a regulated entity or a small business, or their respective processor, processes to associate or identify a consumer with the data described in… [3-16] … that is deprived or extrapolated from nonhealth information” is considered physical or mental health status and is regulated by the WMHMDA. | Section 3(8)(b)(xiii) |
| 18. Data identifying a consumer seeking services to assess mental or physical health | Data that identifies a consumer seeking services to assess a personal’s mental or physical health is considered physical or mental health status and is regulated by the WMHMDA. | Sections 3(8)(b)(xii), 3(15) |
| 19. Data identifying a consumer seeking services to measure mental or physical health | Data that identifies a consumer seeking services to measure a personal’s mental or physical health is considered physical or mental health status and is regulated by the WMHMDA. | Sections 3(8)(b)(xii), 3(15) |
| 20. Data identifying a consumer seeking services to improve mental or physical health | Data that identifies a consumer seeking services to improve a personal’s mental or physical health is considered physical or mental health status and is regulated by the WMHMDA. | Sections 3(8)(b)(xii), 3(15) |
| 21. Data identifying a consumer seeking to learn about mental or physical health | Data that identifies a consumer seeking services to learn a personal’s mental or physical health is considered physical or mental health status and is regulated by the WMHMDA. | Sections 3(8)(b)(xii), 3(15) |
| 22. Data identifying a consumer seeking services on health conditions and status | Data that identifies a consumer seeking services to assess, measure, improve, or learn about an individual’s health condition or status is considered physical or mental health status and is regulated by the WMHMDA. | Sections 3(8)(b)(xii), 3(15)(a) |
| 23. Data identifying a consumer seeking services on diseases or diagnoses | Data that identifies a consumer seeking services to assess, measure, improve, or learn about an individual’s disease or diagnose is considered physical or mental health status and is regulated by the WMHMDA. | Sections 3(8)(b)(xii), 3(15)(a) |
| 24. Data identifying a consumer seeking services on medical interventions | Data that identifies a consumer seeking services to assess, measure, improve, or learn about medical interventions, including social, psychological, and behavioral interventions is considered physical or mental health status and is regulated by the WMHMDA. | Sections 3(8)(b)(xii), 3(15)(b) |
| 25. Data identifying a consumer seeking services for health-related procedures | Data that identifies a consumer seeking services to assess, measure, improve, or learn about health-related surgeries or procedures is considered physical or mental health status and is regulated by the WMHMDA. | Sections 3(8)(b)(xii), 3(15)(c) |
| 26. Data identifying a consumer seeking services for medications | Data that identifies a consumer seeking services to assess, measure, improve, or learn about use or purchase of medication is considered physical or mental health status and is regulated by the WMHMDA. | Sections 3(8)(b)(xii), 3(15)(d) |
| 27. Data identifying a consumer seeking services on bodily functions and vital signs | Data that identifies a consumer seeking services to assess, measure, improve, or learn about bodily functions and vital signs is considered physical or mental health status and is regulated by the WMHMDA. | Sections 3(8)(b)(xii), 3(15)(e) |
| 28. Data identifying a consumer seeking services on symptoms | Data that identifies a consumer seeking services to assess, measure, improve, or learn about symptoms is considered physical or mental health status and is regulated by the WMHMDA. | Sections 3(8)(b)(xii), 3(15)(e) |
| 29. Data identifying a consumer seeking services for measurements of information | Data that identifies a consumer seeking services to assess, measure, improve, or learn about measurements of information described in rows 18-28 and 30 to 33 is considered physical or mental health status and is regulated by the WMHMDA. | Sections 3(8)(b)(xii), 3(15)(e) |
| 30. Data identifying a consumer seeking services for diagnostic testing | Data that identifies a consumer seeking services to assess, measure, improve, or learn about diagnoses or diagnostic testing is considered physical or mental health status and is regulated by the WMHMDA. | Sections 3(8)(b)(xii), 3(15)(f) |
| 31. Data identifying a consumer seeking services for treatment | Data that identifies a consumer seeking services to assess, measure, improve, or learn about treatments, including medications, is considered physical or mental health status and is regulated by the WMHMDA. | Sections 3(8)(b)(xii), 3(15)(f) |
| 32. Data identifying a consumer seeking services for reproductive health care | Data that identifies a consumer seeking services to assess, measure, improve, or learn about reproductive health care is considered physical or mental health status and is regulated by the WMHMDA. Reproductive or sexual health services are “health services or products that support or relate to a consumer’s reproductive system or sexual well-being.” | Sections 3(8)(b)(xii), 3(15)(g), 3(25)(a)-(g) (providing reproductive or sexual health care services definition) |
| 33. Data identifying a consumer seeking services for gender-affirming care | Data that identifies a consumer seeking services to assess, measure, improve, or learn about gender-affirming care is considered physical or mental health status and is regulated by the WMHMDA. Gender affirming care services are “health services or products that support and affirm an individual’s gender identity,” including treatments for gender dysphoria, gender affirming hormone therapy and surgical procedures, and medical interventions. | Sections 3(8)(b)(xii), 3(15)(h), 3(12) (providing gender-affirming care service definition) |
Mike Summers a law clerk in Greenberg Traurig's Data Privacy & Cybersecurity Practice contributed to this article
