Law note · Washington
HB 1155, My Health My Data Act
Requires a private regulated entity to obtain separate, affirmative opt-in consent before collecting or sharing a Washington consumer's health data, a category that includes biometric data extracted from imagery or voice recordings with no exclusion for a recording-derived identifier, and a further signed authorization before selling it.
Bans geofencing within 2,000 feet of a health care facility to identify, track, or notify consumers seeking care, and grants consumers the right to confirm, access, withdraw consent to, and delete their data within 45 days, extendable once by 45 more days.
What it asks of an app
- Obtain separate, affirmative opt-in consent before collecting or sharing a Washington consumer's health data, including any biometric identifier used to infer a health condition, whether captured live or extracted from a stored photo, video, or audio recording.
- Obtain a further signed authorization before selling consumer health data.
- Do not geofence within 2,000 feet of a health care facility to identify, track, or send notifications to consumers seeking care.
- Honor a consumer's request to confirm, access, or delete their consumer health data within 45 days, extendable once by 45 additional days.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, crawls_web, automated_outreach, deploys_chatbot
Primary source: official codified statute text, Revised Code of Washington, and the official Washington State Legislature bill history for HB 1155