Law / United States / 
Washington
HB 1155, My Health My Data Act
RCW 19.373; HB 1155, chapter 191, Laws of 2023
In force since .
A sensitive categories rule binding private bodies.
- Audit expectation
- none
What it requires
- Obtain separate, affirmative opt-in consent before collecting or sharing a Washington consumer's health data, including any biometric identifier used to infer a health condition, whether captured live or extracted from a stored photo, video, or audio recording.NIST Privacy FrameworkCT.PO-P1
- Obtain a further signed authorization before selling consumer health data.NIST Privacy FrameworkCT.PO-P1
- Do not geofence within 2,000 feet of a health care facility to identify, track, or send notifications to consumers seeking care.NIST Privacy FrameworkCT.PO-P1
- Honor a consumer's request to confirm, access, or delete their consumer health data within 45 days, extendable once by 45 additional days.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text. Also read by: Washington State Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Available to the Washington Attorney General, who may enforce this chapter under the Consumer Protection Act because RCW 19.373.090 deems a violation an unfair or deceptive act under RCW 19.86.020. An injured consumer may separately sue under the Act's own private right of action, RCW 19.86.090.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 7,500
Statutory damages
No fixed per-person amount: an injured consumer's private action under RCW 19.86.090 recovers actual damages, court costs, and attorney's fees, and the court may in its discretion increase the damages award up to three times actual damages, with that enhancement capped at $25,000 for a violation of RCW 19.86.020, the provision this Act's violations are deemed to violate.
- As of
Who enforces it
Enforcement body
Washington Attorney General, enforcing this chapter as an unfair or deceptive act under the Consumer Protection Act, RCW 19.86 (injunctive relief under RCW 19.86.080, civil penalties under RCW 19.86.140); an injured consumer may also bring a private civil action under RCW 19.86.090.
Settledness
- As of
- Guidance link
- https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy
- Guidance body
- Washington State Office of the Attorney General
- Open questions
- Is biometric data, such as a faceprint extracted from a photograph, 'consumer health data' under RCW 19.373.010(8) when it does not identify the consumer's past, present, or future physical or mental health status?
What it reaches
Excludes recording-derived identifiersNo
How the hook was established
express
What makes it apply
Operator establishment, Market targeting, Data subject residence, User location
Obligation class
Consent, Data subject rights, Prohibition, Biometric
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- Conducts business in Washington, or produces or provides products or services that are targeted to consumers in Washington
- Alone or jointly with others, determines the purpose and means of collecting, processing, sharing, or selling of consumer health data
What it makes you log
What the log must hold
Consent or opt-out state
Log retention
Six years is a minimum, running from the date of the authorization's signature or the date when it was last in effect, whichever is later; the section states no end date.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 6
Logging duty
The seller and the purchaser of consumer health data must each retain a copy of every valid authorization for sale of consumer health data, which the consumer signs and which carries, among other things, the data to be sold, an expiration date one year from signing and the consumer's signature and date (RCW 19.373.070(2)). The copy is the consent record. The chapter names no other log or record: the consumer health data privacy policy (RCW 19.373.020) and the data security practices (RCW 19.373.050) state rules, and a regulated entity's burden of demonstrating that a request is manifestly unfounded or that a research or other exemption applies (RCW 19.373.040, 19.373.100) is a burden of proof in a dispute rather than a kept record. The consumer is given a copy of the signed authorization at signing (RCW 19.373.070(4)), which is delivery of the consumer's own document and sets no right to read the retained copies. The Attorney General enforces the chapter as a violation of the Consumer Protection Act (RCW 19.373.090); the chapter does not say the Attorney General may demand the retained copies.
- Kind
- Explicit
- As of
- Provision
- RCW 19.373.070(5)
- Trigger
- consent_or_optout
What this law does
Requires a private regulated entity to obtain separate, affirmative opt-in consent before collecting or sharing a Washington consumer's health data, a category that includes biometric data extracted from imagery or voice recordings with no exclusion for a recording-derived identifier, and a further signed authorization before selling it.
Bans geofencing within 2,000 feet of a health care facility to identify, track, or notify consumers seeking care, and grants consumers the right to confirm, access, withdraw consent to, and delete their data within 45 days, extendable once by 45 more days.
When LexLint raises it
When your app profile says your app processes biometric data, sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .