I'm Mary Ann Kolbasek McGee, Executive Editor at Information Security Media Group. Today, I'm speaking with Attorney Kat Kozlowski of the law firm, Pulse and Ellie, about Washington State's new My Health, My Data Act, or MHMD, which is said to include some of the most restrictive provisions in the U.S. when it comes to state privacy laws. The law is set to take effect on March 31st of 2024.
So, Kat, for starters, what stands out to you about Washington State's new MHMD act, and why is this law getting so much attention? At many levels, it's just how amazing the reach this law has. From who it applies to, to what data is involved. It's not a what we've traditionally thought of as a comprehensive privacy law that we've seen popping up in many other states, but even though it's focused on consumer health data, that definition in and of itself is such a broad reach that its boundaries are very fuzzy.
So, when it comes to broad reach, what's included? So, the definition of consumer health data, it's not just what we would normally think of. Our default is usually to think of health data as what's covered by HIPAA, right? This law very specifically says HIPAA data is excluded, and it's a reaction to the DOPS case and the data associated with what we think of as reproductive health information.
It's sort of what this is reactive to, but it captures so much more than that. So, if you look at the definition, it's any personal information linked or reasonably linkable to a consumer that identifies physical or mental health status. It's like, okay, that's one start of the bubble. But when you dig into the definition even further, it includes medications, symptoms, biometric data, genetic data, gender affirming care, reproductive or sexual health information, this could go anywhere from what we think this law was really trying to attack, such as period tracker data, to whether you're going to target to go by title.
So, the data that's collected or the data that's sort of covered under this, how does this data generally get generated? Would it be data that is on or created on mobile devices or geo-location healthcare related info, data that goes into a person's personal health record or blue sorts of apps that might be on their phones? What sorts of things are covered? It's sort of an all-of-the-above situation.
When it comes to health record data, if you're covered by HIPAA, there is an exception here for data that falls under PHI under HIPAA. Now, what's important to note there is that it's not an exception for covered entities. It's only for the data itself that is covered by HIPAA. But when we're talking about collection, it's historically kind of important to take a step back and think about how we got here.
I mean, when we first got into the world of having phones collecting all of our information or being able to track a period on a digital calendar or an app or sending our birth date to sign up for a newsletter, we slowly, as a community or society or what have you, created this culture of sharing a lot of data with a lot of folks and a lot of companies and entities. And so, there's been this creep of constant information being saved by various entities where I think a lot of people are suddenly going, hey, wait a minute, who knows everything about me? It's kind of everyone. So, it's data collected by your apps, data collected by what you put in a website, and then data collected that you don't even realize you're letting out.
Like, a big part of this new law is the geofencing rule. A lot of time we don't think about if you have your phone in your pocket and you're walking around, the cell towers are picking up exactly where you are, which directs to the geofencing part of this law, right? That was in reaction to situations where, say, an individual is traveling to some sort of medical clinic, what was happening is as they would approach advertisements would come to their phone via text message, picking up where they are via geofencing to send targeted ads. The reaction, particularly in correlation with Adobe's case, was to prevent ads going to folks approaching abortion clinics to advise them to go elsewhere.
But that technology is used in a lot of other situations. I mean, when I go into Target, when I walk in the door, I immediately get what the latest coupons are. So, geofencing is used in a lot of different respects, and this is going to impact that as well. So, what is the impact?
What is it that companies will need to do? The short answer is a lot. First, what's important to note in terms of the companies is it's everybody. It's any company, they call it a regulated entity.
So, a regulated entity is going to be any business that or any entity that conducts business in Washington, or an entity that produces or provides products or services targeted to consumers in Washington, and it's to protect residents of Washington or someone passing through Washington. So, any national entity is going to be impacted by this law. Now, what they have to do is also pretty broad. It starts with what seems like a simple concept that we've gotten used to, which is notice entities are going to have to provide a privacy notice that explains what they are doing with your data, particularly consumer health data, what you're doing with it, who you're giving it to, all that fun stuff.
But it also creates an active responsibility on entities to obtain consent, to share that data, to process that data, you have to actively get explicit consent from the ultimate user, unless that implicit consent is based on the requested product or service. So, if what an entity is doing, it's obvious that you're saying, hey, I need this data x to do y, and you say, okay, here's my data, there's your consent. But any outside use of that, they have to get explicit consent as opposed to just saying a heads up. What's also created are additional consumer rights that we're seeing a lot of these comprehensive laws where it's a right to access by the consumer information on what third parties this information is going to, and a right to delete.
So, a consumer needs to be able to have the ability to go, hey, I know you have this information about me. Not only do you have to delete it in whatever you're actively using, you have to delete it in your backups, and you have to let anybody who've given this to know that I've requested this deletion and have the contract set up to make sure that happens. So, Kat, again, this law does not take effect until March 31st of 2024. Sounds like there's a lot of work that companies will need to be thinking about doing to comply to this new set of expectations.
What's your advice? Where should companies get started in figuring out what they need to do? Well, there's actually a sneaky detail in here that I think a lot of people are missing, in that each of the sections say that it does not kick in until 2024, except for the geofencing section. The geofencing section does not have that qualifier, and without that qualifier giving it a late kickoff, it starts 90 days after the Washington State legislative period.
So, the geofencing provision is actually going to kick in pretty quick here. As for the rest of it, I think folks really need to take a second look at what data they're collecting and how it can be interpreted. If you look at, say, websites that have the option of you uploading your image and trying on clothes on top of it, or glasses, that's sending information that could be classified as consumer health data, even though it's not being used to identify an individual and their health status. So, there's really going to need to be a moment where everybody takes a minute and goes, where am I operating?
Who's using my product? And does my data fit in this very broad definition of consumer health information? So, Kat, as you know, I'm sure we've been hearing a lot about the use of web crackers on websites that in some cases it's healthcare related websites, and there's been a number of class action lawsuits about the use of, for instance, the amount of pixel sending patient information or identifiers to Facebook, and there's a whole controversy that's been stirring about that. How would all that fit in with this in terms of Washington State companies or companies that collect residents of Washington State's health data?
Are there certain considerations where these things will either mesh together or conflict? Or is there much of a relationship between the use of web crackers that might be involved with sending health information? That's a really interesting question. I mean, with the law has also concluded any sort of biometric information and anything really related to health.
So, in terms of web tracking, I suppose it's whether somebody wants to contort the concept of what people hover over or what folks are searching within their website and how they use it as consumer health information or consumer health data to use the correct term. Included in that definition is any social, psychological, behavioral, and medical interventions. So, if somebody is collecting any of this metric data that could potentially be used in that fashion, regardless of whether or not it is, I can see a creative person making an argument there. And without more clarification on the law, we just don't know.
And you had said that it's not really a privacy law per se, but is there any other states that have anything that's similar to this or is this sort of a new innovation when it comes to health data? It's really innovative in the breadth that it takes on. The closest I can really relate is BIPA, the Illinois Biometric Information Privacy Act, because BIPA was really one of the first of its kind to tackle protecting health information in such an intense manner. And where a similarity pops up for both of those as well is the private right of action.
This has been really a big spotlight on BIPA and its ability for individuals to bring causes of action to data collectors for, say, using their fingerprints for checking into work and whatnot. This law as well, my health made my data gives a private right of action to consumers to sue if they feel their health-related information has been collected by an entity without their consent or the much stronger regulations surrounding being able to sell that information, which requires a separate consent. So, Kat, besides the My Health, My Data Act, anything else that's sort of emerging that you're keeping your eye on when it comes to health data privacy-related issues? Well, it's been exciting to see the privacy law lately watching as these comprehensive state privacy laws have sort of lingered in their state legislatures for quite a while now.
And for so many to finally be passing, I do think it's in response to Dobbs and this movement of recognizing how much is out there about ourselves and how that can be used really against us, but also for us. I'm really curious to see how the medical research world is sort of going to react to these laws, because while there's exceptions, they're not the clearest guidelines as to where you can use this information down the line. So, I'm really keeping an eye on how particularly academic medical centers, research facilities are going to respond and push back about how they can utilize data for our greater good, instead of only focusing on how it can be weaponized. Well, thank you so much, Kat.
I've been speaking to Attorney Kat Kozlowski. I'm Mary Ann Kolbasak-McGee of Information Security Media Group. Thanks for joining us.