In a Bloomberg Law article, attorneys examined Washington State’s comprehensive new privacy law, the My Health My Data Act, the first state law that specifically safeguards consumer health data.
The article discusses the new law’s scope, applicability, and ensuing company obligations. The Act will apply to many life sciences companies, pharmaceutical and device manufactures and is enforceable through a private right of action, creating a risk of class action litigation related to potential violations.
The Act requires regulated entities and small businesses to develop a website privacy policy; secure opt-in consent prior to collecting and sharing identifiable consumer health data; obtain prior authorization to sell consumer health data; create mechanisms to track, respond to and grant consumer rights; implement reasonable security measures; ensure data protection agreements are in place with processors; and eliminate any geofences around entities that provide in-person health care services.