United States: Four takeaways from the Washington State Attorney General's Guidance on the My Health My Data Act

In brief

Beyond the statutory text of the new Washington state My Health My Data Act, the Washington Attorney General has published Frequently Asked Questions (FAQs) and will update such FAQs periodically. Some of the FAQs provide insight into possible interpretations of the law's provisions that are summarized below.  For a broader overview of the My Health My Data Act, see here.


  1. Businesses located outside of the state of Washington that only store data in Washington are not regulated entities

Per Section 3 (7), the act protects "consumers," which includes a natural person whose consumer health data is collected in Washington. "Collect" is defined in Section 3 (5) to include the processing of consumer health data in any manner. Questions have been raised if this means that a business located outside of Washington that collects consumer health data about individuals outside of Washington but that stores such data in Washington is a regulated entity subject to the act. The FAQs assert that an entity that only stores data in Washington is not a regulated entity.

  1. Regulated entities are required to publish a privacy policy on their Internet homepage

If there was any doubt, the FAQs refer to Section 4(1)(b) of the act, per which a regulated entity shall prominently publish a link to its consumer health data privacy policy on its homepage. This is similar to the California Consumer Privacy Act, pursuant to which a business is required to publish a privacy policy on its homepage.

  1. Inferences about a consumer's health status from purchases of products could be considered consumer health data

Consumer health data is defined as "personal information that is linked or reasonably linkable to a consumer, and that identifies the consumer's past, present, or future physical or mental health status". The definition goes on to give non-exhaustive examples of physical or mental health status. Questions have been raised if inferences drawn about a consumer's health status from purchases of products could be considered consumer health data. The FAQs assert that, yes, any inferences drawn from purchases could be consumer health data. In contrast, non-health data that a regulated entity collects but does not process to identify or associate with a physical or mental health status is not consumer health data.

  1. Contradictory retention and deletion requirements should be solved by redaction

Under Section 9 of the act, it is unlawful for anyone to sell or offer to sell consumer health data without first obtaining valid authorization from the consumer. When a consumer grants a person valid authorization to sell their consumer health data, both the seller and purchaser are required to retain a copy of the valid authorization for six years. Section 6 of the act empowers consumers to have their consumer health data deleted from a regulated entity's network, including archived or backup systems. Begging the question of how the retention and deletion requirements can be reconciled.

The FAQ guidance provides that if, after executing a valid authorization, a consumer exercises their Section 6 right to have their consumer health data deleted, a regulated entity may meet its obligation to delete the consumer's health data and its obligation to retain a copy of the valid authorization by redacting the portion of the valid authorization that specifies the consumer health data for sale (for example, by applying a redaction that states: "REDACTED pursuant to consumer deletion request on [insert date]").

Contact Information

Copyright © 2024 Baker & McKenzie. All rights reserved. Ownership: This documentation and content (Content) is a proprietary resource owned exclusively by Baker McKenzie (meaning Baker & McKenzie International and its member firms). The Content is protected under international copyright conventions. Use of this Content does not of itself create a contractual relationship, nor any attorney/client relationship, between Baker McKenzie and any person. Non-reliance and exclusion: All Content is for informational purposes only and may not reflect the most current legal and regulatory developments. All summaries of the laws, regulations and practice are subject to change. The Content is not offered as legal or professional advice for any specific matter. It is not intended to be a substitute for reference to (and compliance with) the detailed provisions of applicable laws, rules, regulations or forms. Legal advice should always be sought before taking any action or refraining from taking any action based on any Content. Baker McKenzie and the editors and the contributing authors do not guarantee the accuracy of the Content and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the Content. The Content may contain links to external websites and external websites may link to the Content. Baker McKenzie is not responsible for the content or operation of any such external sites and disclaims all liability, howsoever occurring, in respect of the content or operation of any such external websites. Attorney Advertising: This Content may qualify as “Attorney Advertising” requiring notice in some jurisdictions. To the extent that this Content may qualify as Attorney Advertising, PRIOR RESULTS DO NOT GUARANTEE A SIMILAR OUTCOME. Reproduction: Reproduction of reasonable portions of the Content is permitted provided that (i) such reproductions are made available free of charge and for non-commercial purposes, (ii) such reproductions are properly attributed to Baker McKenzie, (iii) the portion of the Content being reproduced is not altered or made available in a manner that modifies the Content or presents the Content being reproduced in a false light and (iv) notice is made to the disclaimers included on the Content. The permission to re-copy does not allow for incorporation of any substantial portion of the Content in any work or publication, whether in hard copy, electronic or any other form or for commercial purposes.