On April 27, 2023, Washington Governor Jay Inslee signed into law the “My Health My Data Act,” (the “Act”), beginning the 11-month countdown until this new, broad privacy law takes effect. The Act distinguishes itself from other recent state privacy law legislation in that it is specifically health care focused—aiming to protect health data that falls outside the scope of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). In attempting to safeguard this category of information, Washington has enacted a broad law that will require robust compliance efforts from entities generally considered outside of traditional health care regulatory regimes. Further, the private right of action present in the Act sets a new stage for potential litigation and subsequent changes based on judicial interpretation.
In this Alert, we provide a summary of key provisions of the new law, compliance concerns, and actions businesses can take to prepare for the March 31, 2024 effective date.
Regulated entities are defined broadly. Spurned by post-Dobbs privacy concerns, the stated intent of the Act is to “close the gap” between the health information that individuals believe is protected and what actually is. To this end, the scope of the Act is broad, applying to “regulated entities,” which are defined as any entities that conduct business or target consumers in Washington and—jointly or unilaterally—determines the purpose and means of...
Three Houston-area individuals accused of belonging to a sovereign-citizen group have been indicted in federal court on charges of falsely claiming to be diplomats of the “Moroccan Empire,” accord...