What Is Covered Under Washington’s My Health, My Data Act

David A. Zetoony

Email

303.685.7425

Bio and Articles

Washington’s My Health, My Data Act: What Types Of Data Are Regulated Under Washington’s New Law?

by: David A. Zetoony of Greenberg Traurig, LLP -

Sunday, June 4, 2023

Print Mail Download

On April 27, 2023, Washington’s Governor signed Washington’s My Health, My Data Act (“WMHMDA” or “Act”). Starting March 31, 2024, most entities subject to the Act will have certain obligations towards consumer health data,[1] including providing consumers with the right to access their information, withdraw their consent to certain processing, and request the deletion of their information. While the Act was promoted as a measure to help protect reproductive and gender affirming care, whether intended or not, its scope goes beyond those discreet issues.*

What entities are regulated?

Under Section 3(23) of the WMHMDA, a Regulated entity is one that (a) conducts business in Washington or produces or provides products or services targeting consumers in Washington, and (b) “alone or jointly with others, determines the purpose and means of collecting, processing, sharing, or selling of consumer health data.” For a list of excepted entities or processing activities, please see GT’s previous blog post here.

What types of data are regulated?

Consumer health data as defined within the WMHMDA is broad and encompasses many potential processing activities. Moreover, the term health care services is incorporated within consumer health data, whereby if a regulated entity provides certain services, in addition the processing activities outlined in the definition of consumer health data, then those services are regulated by the WMHMDA.

Below is a chart that presents and summarizes the types of data that may be included within consumer health data.

Data Types	Description of Processing Activity	Statutory Reference
1. Information about mental or physical health status	The main definition of consumer health data is broad and includes any “personal information that is linked or reasonably linkable to a consumer” and “identifies that consumer’s past, present, or future physical or mental health status.” Personal information is likewise defined broadly under the WMHMDA as “information that identifies or reasonable capable of being associated or linked, directly, or indirectly, with a particular consumer.” As a result, any personal information of a consumer that is about any portion of that consumer’s mental or physical health is consumer health data and is regulated by the WMHMDA.	Section 3(8)(a), 3(18)(a) (providing the personal information definition)
2. Information related to providing a health care service	Personal information related to providing a consumer with health care services is considered physical or mental health status and is regulated by the WMHMDA. In addition to services listed in 18-33 below, health care services are “any service[s] provided to a person to assess, measure, improve, or learn about a person’s mental or physical health.”	Section 3(8)(b)(xii), 3(15)
3. Information on treatments or diagnosis	Personal information related to an individual’s health condition, treatment, diseases, or diagnosis of such items is considered physical or mental health status and is regulated by the WMHMDA.	Section 3(8)(b)(i),
4. Information on medical interventions	Personal information related to an individual’s social, psychological, behavioral, or medical interventions is considered physical or mental health status and is regulated by the WMHMDA.	Section 3(8)(b)(ii)
5. Information on surgeries or procedures	Personal information related to an individual’s surgery or procedure is considered physical or mental health status and is regulated by the WMHMDA.	Section 3(8)(b)(iii)
6. Information on medication	Personal information related to an individual’s use or purchase of prescribed medication is considered physical or mental health status and is regulated by the WMHMDA.	Section 3(8)(b)(iv)
7. Information on bodily functions	Personal information related to an individual’s bodily functions is considered physical or mental health status and is regulated by the WMHMDA.	Section 3(8)(b)(v)
8. Information on vital signs	Personal information related to an individual’s vital signs is considered physical or mental health status and is regulated by the WMHMDA.	Section 3(8)(b)(v)
9. Information on symptoms	Personal Information related to an individual’s symptoms is considered physical or mental health status and is regulated by the WMHMDA.	Section 3(8)(b)(v)
10. Information on measurements of health information	Personal information related to an individual’s measurements of medical information described in this table is considered physical or mental health status and is regulated by the WMHMDA.	Section 3(8)(b)(v)
11. Information on diagnostic testing	Personal information related to an individual’s diagnoses or diagnostic testing, treatment, or medication is considered physical or mental health status and is regulated by the WMHMDA.	Section 3(8)(b)(vi)
12. Information on gender-affirming care	Personal information related to an individual’s use of gender-affirming care and associated information of such care is considered physical or mental health status and is regulated by the WMHMDA. “Gender affirming care information” is “personal information relating to seeking or obtaining past, present, or future, gender-affirming care services” and includes, but is not limited to, precise geolocation that could indicate a person is attempting to receive such services, efforts to research these services, or any gender-affirming care information that is derived, extrapolated or inferred from nonhealth information.	Sections 3(8)(b)(vii), 3(11)(a)-(c) (providing gender-affirming care definition)
13. Information on reproductive health information	Personal information related to an individual’s reproductive or sexual health information is considered physical or mental health status and is regulated by the WMHMDA. “Reproductive or sexual health information” is any “personal information relating to seeking or obtaining past, present, or future reproductive or sexual health services” and includes, but not limited to precise geolocation that could indicate a person is attempting to receive such services, efforts to research these services, or any reproductive or sexual health information that is derived, extrapolated or inferred from nonhealth information.	Sections 3(8)(b)(viii), 3(24)(a)-(c) (providing reproductive health information definition)
14. Biometric data	An individual’s biometric data is considered physical or mental health status and is regulated by the WMHMDA. “Biometric data” is any “data that is generated from the measurement or technological processing of an individual’s physiological, biological, or behavioral characteristics and that identifies a consumer, whether individually or in combination with other data.” Such data may include imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, voice patterns or recordings, and “keystroke patterns or rhythms and gain patterns or rhythms that contain identifying information.”	Sections 3(8)(b)(ix), 3(4) (a)(b) (providing the biometric data definition)
15. Genetic data	An individual’s genetic data is considered physical or mental health status and is regulated by the WMHMDA. “Genetic data” is “any data, regardless of its format, that concerns a consumer’s genetic characteristics.” This may include raw sequencing or portions of DNA, genotypic and phenotypic information, and self-reported health data that a consumer submits to a regulated entity where such data is analyzed in connection with a consumer’s raw sequence data.	Sections 3(8)(b)(x), 3(13)(a)-(c) (providing genetic data definition)
16. Precise locations	An individual’s precise location whereby it could reasonably indicate a consumer’s attempt to acquire or receive health services or supplies is considered physical or mental health status and is regulated by the WMHMDA. Precise location is information derived from technology that locates an individual within a radius of 1,750 feet.	Sections 3(8)(b)(xi), 3(19) (providing precise location information definition)
17. Information derived from nonhealth information.	Processing related to any information “that a regulated entity or a small business, or their respective processor, processes to associate or identify a consumer with the data described in… [3-16] … that is deprived or extrapolated from nonhealth information” is considered physical or mental health status and is regulated by the WMHMDA.	Section 3(8)(b)(xiii)
18. Data identifying a consumer seeking services to assess mental or physical health	Data that identifies a consumer seeking services to assess a personal’s mental or physical health is considered physical or mental health status and is regulated by the WMHMDA.	Sections 3(8)(b)(xii), 3(15)
19. Data identifying a consumer seeking services to measure mental or physical health	Data that identifies a consumer seeking services to measure a personal’s mental or physical health is considered physical or mental health status and is regulated by the WMHMDA.	Sections 3(8)(b)(xii), 3(15)
20. Data identifying a consumer seeking services to improve mental or physical health	Data that identifies a consumer seeking services to improve a personal’s mental or physical health is considered physical or mental health status and is regulated by the WMHMDA.	Sections 3(8)(b)(xii), 3(15)
21. Data identifying a consumer seeking to learn about mental or physical health	Data that identifies a consumer seeking services to learn a personal’s mental or physical health is considered physical or mental health status and is regulated by the WMHMDA.	Sections 3(8)(b)(xii), 3(15)
22. Data identifying a consumer seeking services on health conditions and status	Data that identifies a consumer seeking services to assess, measure, improve, or learn about an individual’s health condition or status is considered physical or mental health status and is regulated by the WMHMDA.	Sections 3(8)(b)(xii), 3(15)(a)
23. Data identifying a consumer seeking services on diseases or diagnoses	Data that identifies a consumer seeking services to assess, measure, improve, or learn about an individual’s disease or diagnose is considered physical or mental health status and is regulated by the WMHMDA.	Sections 3(8)(b)(xii), 3(15)(a)
24. Data identifying a consumer seeking services on medical interventions	Data that identifies a consumer seeking services to assess, measure, improve, or learn about medical interventions, including social, psychological, and behavioral interventions is considered physical or mental health status and is regulated by the WMHMDA.	Sections 3(8)(b)(xii), 3(15)(b)
25. Data identifying a consumer seeking services for health-related procedures	Data that identifies a consumer seeking services to assess, measure, improve, or learn about health-related surgeries or procedures is considered physical or mental health status and is regulated by the WMHMDA.	Sections 3(8)(b)(xii), 3(15)(c)
26. Data identifying a consumer seeking services for medications	Data that identifies a consumer seeking services to assess, measure, improve, or learn about use or purchase of medication is considered physical or mental health status and is regulated by the WMHMDA.	Sections 3(8)(b)(xii), 3(15)(d)
27. Data identifying a consumer seeking services on bodily functions and vital signs	Data that identifies a consumer seeking services to assess, measure, improve, or learn about bodily functions and vital signs is considered physical or mental health status and is regulated by the WMHMDA.	Sections 3(8)(b)(xii), 3(15)(e)
28. Data identifying a consumer seeking services on symptoms	Data that identifies a consumer seeking services to assess, measure, improve, or learn about symptoms is considered physical or mental health status and is regulated by the WMHMDA.	Sections 3(8)(b)(xii), 3(15)(e)
29. Data identifying a consumer seeking services for measurements of information	Data that identifies a consumer seeking services to assess, measure, improve, or learn about measurements of information described in rows 18-28 and 30 to 33 is considered physical or mental health status and is regulated by the WMHMDA.	Sections 3(8)(b)(xii), 3(15)(e)
30. Data identifying a consumer seeking services for diagnostic testing	Data that identifies a consumer seeking services to assess, measure, improve, or learn about diagnoses or diagnostic testing is considered physical or mental health status and is regulated by the WMHMDA.	Sections 3(8)(b)(xii), 3(15)(f)
31. Data identifying a consumer seeking services for treatment	Data that identifies a consumer seeking services to assess, measure, improve, or learn about treatments, including medications, is considered physical or mental health status and is regulated by the WMHMDA.	Sections 3(8)(b)(xii), 3(15)(f)
32. Data identifying a consumer seeking services for reproductive health care	Data that identifies a consumer seeking services to assess, measure, improve, or learn about reproductive health care is considered physical or mental health status and is regulated by the WMHMDA. Reproductive or sexual health services are “health services or products that support or relate to a consumer’s reproductive system or sexual well-being.”	Sections 3(8)(b)(xii), 3(15)(g), 3(25)(a)-(g) (providing reproductive or sexual health care services definition)
33. Data identifying a consumer seeking services for gender-affirming care	Data that identifies a consumer seeking services to assess, measure, improve, or learn about gender-affirming care is considered physical or mental health status and is regulated by the WMHMDA. Gender affirming care services are “health services or products that support and affirm an individual’s gender identity,” including treatments for gender dysphoria, gender affirming hormone therapy and surgical procedures, and medical interventions.	Sections 3(8)(b)(xii), 3(15)(h), 3(12) (providing gender-affirming care service definition)