The Washington My Health My Data Act: Not Just Washington (or Health)

• Citation: Vol. 1
• Publication year: 2024
• Author: Written by Mike Hintze

THE WASHINGTON MY HEALTH MY DATA ACT: NOT JUST WASHINGTON (OR HEALTH)

Written by Mike Hintze^*

Over the past several years, we've become accustomed to a rapid pace of change in the privacy law landscape—particularly at the U.S. state level. While there have been state privacy laws on the books for decades, the current era of seemingly weekly developments in state privacy law kicked off in 2018 with the adoption of the original California Consumer Privacy Act (CCPA). Since then, more than a dozen other states have enacted other comprehensive privacy laws, typically with broad similarities between them, but with enough significant differences to keep things interesting. Further amendments and/or rulemaking related to those laws creates what feels like a constantly moving target that is extremely challenging for those seeking to track, reconcile, and comply with them.

Earlier this year, a major development in Washington State further complicated this growing patchwork of state privacy laws. The passage of the Washington My Health My Data Act (MHMDA) is easily the most significant development in privacy law of 2023 and may be the most consequential privacy legislation enacted since the original CCPA.

The Act purports to be focused on filling a gap by protecting health data not covered by HIPAA, the federal law that protects the privacy and security health data handled by hospitals, health care providers, and other enumerated "covered entities." But the Act is very different from HIPAA, and it does far more than just filling gaps.

Further, the Act is extremely broad in terms of the types of data covered and the entities that are subject to it. As a result, many companies (and nonprofits) that don't think of themselves as handling health data are surprised when they learn that they may be subject to the Act's obligations.

Those obligations are extensive, in several cases going well beyond what we have seen with any other privacy law. The sweeping scope and extreme substantive obligations, combined with vague terms and a private right of action, make this Act extraordinarily challenging and risky for a very wide range of organizations.

This Act is a privacy law for which perfect, risk-free compliance may be impossible. As entities that are potentially covered by the Act prepare for the March 31, 2024, effective date (June 30 for small businesses), they will need to carefully consider those risks as they determine and prioritize their compliance steps and investments.

PRIVATE RIGHT OF ACTION

In addition to Attorney General enforcement, the Act includes a private right or action, enforceable as a violation of the Washington Consumer Protection Act. The presence of a private right of action is significant, particularly in light of the Act's vague and open-ended language and near-impossible compliance standards.

[Page 14]

Nevertheless, it is important to note that the Washington Consumer Protection Act does not include statutory damages, and to recover actual damages, a plaintiff needs to show both causation and an injury to the plaintiff's "business or property." However, the plaintiffs' bar is nothing if...