Washington Enacts Comprehensive Health Data Privacy Law, MHMD
Washington State has enacted the My Health My Data Act (MHMD), signed by Governor Inslee in April 2023. This legislation significantly impacts organizations handling consumer health data, marking a substantial step in U.S. health data privacy since the Supreme Court's Dobbs decision.
MHMD is the most comprehensive consumer privacy law since California's CCPA, affecting entities collecting, processing, or sharing health data not protected by HIPAA. It lacks common exceptions and does not exempt entities covered by other legal regimes like HIPAA, GLBA, and FERPA. The act allows a full private right of action, benefiting plaintiffs, and is enforceable by the Attorney General.
In contrast, Nevada's SB 370, signed by Governor Lombardo in June 2023, employs a narrower definition of 'consumer health data' and applies to a narrower scope of covered entities than MHMD. While MHMD applies to organizations handling covered data related to Washington State, both within and outside its borders, SB 370's reach is more limited.
MHMD's broad definition of 'consumer health data' implicates a wide range of personal data, entities, and consumers. Both MHMD and SB 370 reflect growing efforts to protect Americans' sensitive health information, with many stakeholders and lawmakers pursuing similar legislation nationwide.
