Just a few years ago, the legal landscape governing health-related personal information was relatively simple: Protected Health Information was regulated under HIPAA. Today, by contrast, the privacy of health-related personal information is under close scrutiny by the FTC, the U.S. Department of Health and Human Services’ Office for Civil Rights and state regulators.

Washington state recently passed the My Health My Data Act, which will almost certainly lead to an explosion of consumer lawsuits and follow-on insurance coverage disputes.

As detailed in Part 1 of this ongoing series, Washington Governor Jay Inslee signed the state’s My Health My Data Act into law on April 27, 2023. In this installment, we provide an overview of the consumer rights bestowed by the Act and the obligations it imposes upon regulated entities and small businesses.

On April 27, 2023, Washington Governor Jay Inslee signed into law House Bill 1155, also known as the My Health, My Data Act. Its stated purpose is to protect “consumer health data” collected by entities not already subject to the federal Health Insurance Portability and Accountability Act, but one less obvious consequence of the Act is that it may make Washington state a new hot spot for class-action litigation involving biometric privacy.

The recently enacted My Health, My Data Act (MHMD) will regulate the collection, use, sharing, analysis, and sale of health-related data of individuals in Washington state and beyond.