USA – WASHINGTON Trends and Developments Contributed by: Alexander A Baehr and Molly Gibbons, Summit Law Group
process consumer health data on behalf of gov- ernmental agencies. Broad scope of data covered and those protected by My Health My Data Act The My Health My Data Act applies to “con- sumer health data”, which is an intentionally broad term. The definition includes “personal information that is linked or reasonably linkable to a consumer and that identifies the consum- er’s past, present or future physical or mental health status”. The Act continues by including 13 examples of what is considered consumer health data, including gender-affirming care, reproductive or sexual health information, biom- etric data, genetic data, and location information that reasonably indicates a consumer’s attempt to acquire or receive health services. Importantly, the My Health My Data Act brings into its ambit general consumer data that is obtained through the use of algorithms or machine learning with the purpose of using such data to associate or identify a consumer with protected health data. Exemptions do exist for specific types of data, such as data protect- ed under the Health Insurance Portability and Accountability Act (HIPPA), certain hospital data, and data de-identified in compliance with HIPAA, among other categories. The exemptions also include data originating from and indistinguish- able from information maintained by a HIPAA- covered entity or business associate. The definition of “consumer” is purposefully broad under the My Health My Data Act. It is defined to include not only Washington residents but also a “natural person whose consumer health data is collected in Washington”. Nota- bly, the term “collect” is also broadly defined to include “buying, renting, accessing, retaining, receiving, acquiring, inferring, deriving, or oth-
erwise processing consumer health data in any manner”. Given these broad definitions, the My Health My Data Act reaches far beyond Washington state. Compliance The My Health My Data Act creates privacy rights for consumers, such as the right to access and delete ‒ as well as withdraw consent for the collection, sharing or sale of ‒ applicable con- sumer health data. The My Health My Data Act requires regulat- ed entities to provide a standalone consumer health data privacy policy. The policy must be accessible via a separate and distinct link on the entity’s home page, which is defined broadly to cover every web page, and the policy must not include irrelevant information that is not required by the Act. In other words, regulated entities must now post a separate health data privacy policy in addition to a general privacy statement. Although the content of the required notice is not unique, the My Health My Data Act uniquely requires entities to name specific affiliates that will have access to consumer health data, thus requiring regulated entities to publicise their internal data flows in a novel manner. The My Health My Data Act imposes three sepa- rate consent and authorisation requirements, as follows. • First, the Act requires regulated entities to ask consumers to opt in before collecting consumer health data, unless the collection is necessary to provide a product or service the consumer has requested. • Second, the Act requires a separate and distinct consent to “share” consumer health data. Sharing is defined uniquely, in that it
1510 CHAMBERS.COM
Powered by FlippingBook