Washington’s My Health My Data Act and Other U.S. Health Data Regulation: Health and Health-ish Data Practices Under the Microscope

With its private right of action and expansive scope – extending far beyond Washington state’s borders and applying to a wide swath of health- and non-health-oriented companies alike – Washington’s My Health My Data Act is poised to be more ground-shifting than any other consumer privacy law that came before it. Kyle Fath, Bola Shonowo and Gicel Tomimbang discussed:

• What is “consumer health data” and who is a “consumer” under the law?
• Key obligations, including privacy policy requirements, consumer rights, and required consents and authorizations for collection, “sharing” and “selling”
• Jurisdictional scope, litigation and enforcement details
• Other legislative and regulatory schemes that are filling the gap left by HIPAA, including health data-specific state privacy laws in Connecticut and Nevada, general state consumer privacy laws, such as the California Consumer Privacy Act (CCPA) and the Colorado Privacy Act (CPA), and the FTC’s Health Breach Notification Rule