United States of America: Implemented My Health My Data Act (HB 1155) for standard regulated entities

On 31 March 2024, the My Health My Data Act (HB 1155) was implemented in the US state of Washington for standard regulated entities. The Act will require entities collecting health data, including biometric, abortion, and mental data, to specify the purpose of collection and the sources from which the data is being collected. Additionally, regulated entities will have to provide a list of businesses with which they share the data, including a point of contact. Furthermore, the entities will have to obtain the individual’s consent for collecting, processing and selling data. Finally, the individuals will have the right to know what type of data has been collected and to opt-out, withdraw their consent and request the deletion of their data. The Act has grace periods of varying periods applying to different kinds of regulated entities. The implementation date is still pending for small businesses, defined as regulated entities either processing or selling health data of fewer than 100'000 consumers annually or deriving less than 50% of revenue from processing or selling health data of fewer than 25'000 consumers, to whom the Act will begin to apply on 30 June 2024.