Overview of the Washington My Health My Data Act
The Washington My Health My Data Act, codified under Chapter 19.373 RCW, establishes comprehensive regulations governing the privacy and security of consumer health data. Enacted in 2023, this law extends its scope to include inferences about health derived from any type of data, not limited to traditional health records. This expansion directly impacts artificial intelligence systems that analyze or generate health-related insights, positioning them within the regulatory framework for the first time in Washington state.
The law mandates that consumers must provide explicit opt-in consent before their health data, including inferences drawn from it, can be collected, shared, or sold. The act also grants consumers a private right of action, allowing individuals to sue for violations of their privacy rights without needing to prove actual harm. This provision significantly raises the stakes for compliance, as non-compliance can lead to litigation risks for organizations deploying health-inference models.
Key Provisions and Their Impact on AI Systems
The act defines consumer health data broadly to encompass not only direct health information but also any data from which inferences about an individual’s health can be made. The inclusion of inferred health data under the law means that any AI system generating or utilizing such data must adhere to the act’s requirements, including consent mechanisms and data security practices.
One of the most critical provisions is the requirement for opt-in consent. Unlike opt-out models used in other privacy laws, Washington’s act demands that consumers actively consent to the collection, sharing, or sale of their health data or any inferences derived from it. Organizations deploying AI models must implement clear and accessible consent processes to avoid legal repercussions.
The act also imposes strict data security practices on entities handling consumer health data. These practices include the implementation of reasonable administrative, technical, and physical safeguards to protect data from unauthorized access, disclosure, alteration, or destruction. Failure to comply with these security standards can result in enforcement actions and potential liability under the law.
Consumer Rights and Enforcement Mechanisms
They also have the right to opt out of the sale or sharing of their data at any time. Organizations must provide clear procedures for consumers to exercise these rights without undue burden.
A significant feature of the act is the private right of action it grants to consumers. For AI developers and deployers, this provision introduces a new layer of risk, as any non-compliance with the act’s requirements could lead to litigation.
The act also includes exemptions for certain entities, such as those governed by the Health Insurance Portability and Accountability Act (HIPAA) or other federal privacy laws. Organizations must carefully assess whether their AI systems are subject to the law’s requirements and take appropriate steps to ensure compliance.
Compliance Requirements for AI Developers and Organizations
- Consent Management: Organizations must implement systems to obtain and document explicit opt-in consent from consumers before collecting, sharing, or selling their health data or any inferences derived from it.
- Transparency and Accountability: Organizations must maintain records of all data collection, sharing, and processing activities related to health inferences. This includes documenting the sources of data, the methods used to derive inferences, and the purposes for which the data is used.
- Security Measures: Robust security practices must be in place to protect health data and inferences from breaches or unauthorized access.
- Consumer Requests: Organizations must establish procedures to handle consumer requests for access, correction, deletion, or opt-out of their health data.
Exemptions and Overlaps with Other Regulations
However, the act’s broad definition of consumer health data means that many AI applications—particularly those in wellness, fitness, or predictive health—may still be captured under its provisions.
Additionally, the act does not preempt more stringent federal or state laws. AI developers operating in multiple jurisdictions must ensure compliance with all applicable laws to avoid conflicts or gaps in protection.
While the Washington act focuses specifically on health data, its provisions may overlap with broader data privacy laws, requiring a coordinated approach to compliance.
Required actions
- Obtain opt-in consent before collecting or sharing consumer health data, including inferences drawn by algorithms about health status - Do not sell consumer health data without signed authorisation; no geofencing of health facilities