iOn April 27, 2023, Washington’s Governor signed Washington’s My Health, My Data Act (WMHMDA or the Act).* Starting March 31, 2024, most entities subject to the Act will have certain obligations toward “consumer health data,”[1] including providing consumers with the right to access their information, withdraw their consent to certain processing, and request the deletion of their information. Shortly after the enactment of WMHMDA, Connecticut amended its privacy statute to also address “consumer health data.” Some now assume that Connecticut has adopted the same measures described in the Washington legislation. However, while both statutes utilize the term “consumer health data,” the statutes treat this term differently.
The following compares each statute’s definition:
| Washington | Connecticut |
|---|---|
| “Consumer health data” means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status.[2] | “Consumer health data” means any personal data that a controller uses to identify a consumer’s physical or mental health condition or diagnosis, and includes, but is not limited to, gender-affirming health data and reproductive or sexual health data.[3] |
While there are several subtle differences in the above definitions, the bolded text may be the most significant as many activities that Washington considers to be related to “physical or mental health status” would not necessarily “identify a consumer’s physical or mental health condition.” For example, Washington’s statute implies that information showing that a person sought to “assess” their physical health would be considered information related to their physical or mental health status and, as a result, consumer health data.[4] That might include, for example, scheduling an appointment with a personal trainer. On the other hand, a Connecticut court may be unlikely to conclude that such information identifies a consumer’s physical or mental health condition or diagnosis. An individual could, of course, schedule an appointment with a physical trainer if they have a health diagnosis such as a heart condition, or they could do so simply to stay in shape.
The following chart compares specific data fields and how they are likely to be treated by the two statutes:
CLICK FOR LARGER IMAGE AND FULL DETAILS (4 pages)
[1] Consumer Health Data “means personal information that is linked or reasonably linkable to a consumer and that identified the consumer’s part, present, or future physical or mental health status.” Section 3(8)(a).
[2] Sub. House Bill 1155, § 3(8)(a) (2023) (hereinafter “WMHMDA”).
[3] Conn. Subst. Senate Bill No. 3, File No. 604, enacted by state legislature and sent for Governor approval Note that if information does not fall under the definition of “consumer health data” it may still be subject to the general requirements of the Connecticut Data Privacy Act which applies to all forms of personal data.
[4] WMHMDA, § 3(8)(b)(xii), 3(15).
