Washington's My Health My Data Act and its Nevada Twin are Now in Effect – Are You Ready?

Washington's My Health My Data Act (Act), which imposes substantial new obligations on the collection and use of broadly defined "consumer health data" (CHD), went into effect March 31, 2024.  Everyone that conducts business in Washington or provides services or products to consumers in Washington should evaluate whether they are processing CHD and are covered by the Act. Our prior blogs on the Act and on guidance from the Washington Attorney General provide key details about the scope of this new law and its obligations, which include the following:

• Entities may be surprised to learn that information that does not seem health-related now is regulated as CHD. CHD is defined broadly as information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. Inferences drawn from non-health care data, such as a consumer's purchases, could be considered CHD. 
• Consumers whose CHD is subject to the Act include not only Washington residents but also anyone residing outside of Washington whose CHD is collected in Washington. 
• The Act imposes strict controls on the collection, sharing, and sale of CHD. Regulated entities may collect, process, or disclose CHD only with the consumer's consent or where necessary to provide a product or service requested by that consumer. The Act prohibits the sale of CHD by any person without "valid authorization" signed by the consumer. The authorization must be a separate document and last no longer than a year.
• Regulated entities must prominently post a link to their consumer health data privacy policy on their homepage that contains information required by the Act. Accuracy is important since regulated entities may collect, share, and sell CHD only as disclosed in their privacy policy. 
• Consumers may request confirmation of CHD processing and access to and deletion of their CHD. 
• The Act prohibits any person from establishing a "geofence" around a facility that provides in-person "health care services" and using the geofence to identify or track consumers, collect CHD, or send notifications, messages, or advertisements related to CHD of health care services. This prohibition went into effect in July 2023 and extends beyond regulated entities to all persons.
• The Washington Attorney General has enforcement authority, and consumers have a private right of action for violations.

Our webinar, available here, also provides additional insights on the Act.  There are many nuances and important exceptions, so close review of the Act is necessary. 

Nevada's new law, S.B. 370 (2023) includes almost identical requirements to the Act and also went into effect on March 31, 2024, covering persons who conduct business in Nevada or provide products or services that are targeted to consumers in Nevada. It uses a similarly broad definition of CHD to encompass not only Nevada residents but also other persons whose CHD is collected in Nevada.

The Davis Wright Tremaine Privacy and Security team has been following My Health My Data Act and Nevada S.B. 370 developments and assisting clients with compliance.