Text of WA HB 1155 (2023)

AN ACT Relating to the collection, sharing, and selling of 1 consumer health data; and adding a new chapter to Title 19 RCW. 2 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON: 3 NEW SECTION. Sec. 1. This act may be known and cited as the 4 Washington my health my data act. 5 NEW SECTION. Sec. 2. (1) The legislature finds that the people 6 of Washington regard their privacy as a fundamental right and an 7 essential element of their individual freedom. Washington's 8 Constitution explicitly provides the right to privacy. Fundamental 9 privacy rights have long been and continue to be integral to 10 protecting Washingtonians and to safeguarding our democratic 11 republic. 12 (2) Information related to an individual's health conditions or 13 attempts to obtain health care services is among the most personal 14 and sensitive categories of data collected. Washingtonians expect 15 that their health data is protected under laws like the health 16 information portability and accountability act (HIPAA). However, 17 HIPAA only covers health data collected by specific health care 18 entities, including most health care providers. Health data collected 19 by noncovered entities, including certain apps and websites, are not 20 Z-0175.4 HOUSE BILL 1155 State of Washington 68th Legislature 2023 Regular Session By Representatives Slatter and Street; by request of Attorney General Prefiled 01/05/23. p. 1 HB 1155 afforded the same protections. This act works to close the gap 1 between consumer knowledge and industry practice by providing 2 stronger privacy protections for all Washington consumers' health 3 data. 4 (3) With this act, the legislature intends to provide heightened 5 protections for Washingtonian's health data by: Requiring additional 6 disclosures and consumer consent regarding the collection, sharing, 7 and use of such information; empowering consumers with the right to 8 have their health data deleted; prohibiting the selling of consumer 9 health data; and making it unlawful to utilize a geofence around a 10 facility that provides health care services. 11 NEW SECTION. Sec. 3. The definitions in this section apply 12 throughout this chapter unless the context clearly requires 13 otherwise. 14 (1) "Abortion" means the termination of a pregnancy for purposes 15 other than producing a live birth. 16 (2) "Affiliate" means a legal entity that shares common branding 17 with another legal entity and controls, is controlled by, or is under 18 common control with another legal entity. For the purposes of this 19 definition, "control" or "controlled" means: 20 (a) Ownership of, or the power to vote, more than 50 percent of 21 the outstanding shares of any class of voting security of a company; 22 (b) Control in any manner over the election of a majority of the 23 directors or of individuals exercising similar functions; or 24 (c) The power to exercise controlling influence over the 25 management of a company. 26 (3) "Biometric data" means data generated from the measurement or 27 technological processing of an individual's physiological, 28 biological, or behavioral characteristics that can be used 29 individually or in combination with other data to identify a 30 consumer. Biometric data includes, but is not limited to: 31 (a) Imagery of the iris, retina, fingerprint, face, hand, palm, 32 vein patterns, and voice recordings, from which an identifier 33 template can be extracted; or 34 (b) Keystroke patterns or rhythms, gait patterns or rhythms, and 35 sleep, health, or exercise data that contain identifying information. 36 (4) "Collect" means to buy, rent, access, retain, receive, 37 acquire, infer, derive, or otherwise process consumer health data in 38 any manner. 39 p. 2 HB 1155 (5)(a) "Consent" means a clear affirmative act by a consumer that 1 openly communicates a consumer's freely given, informed, opt-in, 2 voluntary, specific, and unambiguous written consent, which may 3 include written consent provided by electronic means. 4 (b) "Consent" cannot be obtained by: 5 (i) A consumer's acceptance of a general or broad terms of use 6 agreement or a similar document that contains descriptions of 7 personal data processing along with other unrelated information; 8 (ii) A consumer hovering over, muting, pausing, or closing a 9 given piece of content; or 10 (iii) A consumer's agreement obtained through the use of 11 deceptive designs. 12 (6) "Consumer" means (a) a natural person who is a Washington 13 resident; or (b) a natural person whose consumer health data is 14 collected in Washington. "Consumer" means a natural person who acts 15 only in an individual or household context, however identified, 16 including by any unique identifier. "Consumer" does not include an 17 individual acting in an employment context. 18 (7)(a) "Consumer health data" means personal information relating 19 to the past, present, or future physical or mental health of a 20 consumer including, but not limited to, any personal information 21 relating to: 22 (i) Individual health conditions, treatment, status, diseases, or 23 diagnoses; 24 (ii) Social, psychological, behavioral, and medical 25 interventions; 26 (iii) Health-related surgeries or procedures; 27 (iv) Use or purchase of medication; 28 (v) Bodily functions, vital signs, symptoms, or measurements of 29 the information described in this subsection; 30 (vi) Diagnoses or diagnostic testing, treatment, or medication; 31 (vii) Efforts to research or obtain health services or supplies; 32 (viii) Gender-affirming care information; 33 (ix) Reproductive or sexual health information; 34 (x) Biometric data related to information described in this 35 subsection (7)(a); 36 (xi) Genetic data related to information described in this 37 subsection (7)(a); 38 p. 3 HB 1155 (xii) Location information that could reasonably indicate a 1 consumer's attempt to acquire or receive health services or supplies; 2 or 3 (xiii) Any information described in (a)(i) through (xii) of this 4 subsection that is derived or extrapolated from nonhealth information 5 (such as proxy, derivative, inferred, or emergent data by any means, 6 including algorithms or machine learning). 7 (b) "Consumer health data" does not include personal information 8 that is used to engage in public or peer-reviewed scientific, 9 historical, or statistical research in the public interest that 10 adheres to all other applicable ethics and privacy laws and is 11 approved, monitored, and governed by an institutional review board, 12 human subjects research ethics review board, or a similar independent 13 oversight entity that determines that the regulated entity has 14 implemented reasonable safeguards to mitigate privacy risks 15 associated with research, including any risks associated with 16 reidentification. 17 (8) "Deceptive design" means a user interface designed or 18 manipulated with the potential effect of subverting or impairing user 19 autonomy, decision making, or choice. 20 (9) "Deidentified data" means data that cannot reasonably be used 21 to infer information about, or otherwise be linked to, an identified 22 or identifiable individual, or a device linked to such individual, if 23 the regulated entity that possesses such data (a) takes reasonable 24 measures to ensure that such data cannot be associated with an 25 individual; (b) publicly commits to process such data only in a 26 deidentified fashion and not attempt to reidentify such data; and (c) 27 contractually obligates any recipients of such data to satisfy the 28 criteria set forth in (a) and (b) of this subsection. 29 (10) "Gender-affirming care information" means personal 30 information relating to seeking or obtaining past, present, or future 31 gender-affirming care services. "Gender-affirming care information" 32 includes, but is not limited to: 33 (a) Location information that could reasonably indicate a 34 consumer's attempt to acquire or receive gender-affirming care 35 services; 36 (b) Efforts to research or obtain gender-affirming care services; 37 or 38 p. 4 HB 1155 (c) Any gender-affirming care information that is derived, 1 extrapolated, or inferred, including from nonhealth information, such 2 as proxy, derivative, inferred, emergent, or algorithmic data. 3 (11) "Gender-affirming care services" means health services or 4 products that support and affirm an individual's gender identity 5 including, but not limited to, social, psychological, behavioral, 6 cosmetic, medical, or surgical interventions. "Gender-affirming care 7 services" includes, but is not limited to, treatments for gender 8 dysphoria, gender-affirming hormone therapy, and gender-affirming 9 surgical procedures. 10 (12) "Genetic data" means any data, regardless of its format, 11 that concerns a consumer's genetic characteristics. "Genetic data" 12 includes, but is not limited to: 13 (a) Raw sequence data that result from the sequencing of a 14 consumer's complete extracted deoxyribonucleic acid (DNA) or a 15 portion of the extracted DNA; 16 (b) Genotypic and phenotypic information that results from 17 analyzing the raw sequence data; and 18 (c) Self-reported health data that a consumer submits to a 19 regulated entity and that is analyzed in connection with consumer's 20 raw sequence data. 21 (13) "Geofence" means technology that uses global positioning 22 coordinates, cell tower connectivity, cellular data, radio frequency 23 identification, Wifi data, and/or any other form of location 24 detection to establish a virtual boundary around a specific physical 25 location. 26 (14) "Health care services" means any service provided to a 27 person to assess, measure, improve, or learn about a person's health, 28 including but not limited to: 29 (a) Individual health conditions, status, diseases, or diagnoses; 30 (b) Social, psychological, behavioral, and medical interventions; 31 (c) Health-related surgeries or procedures; 32 (d) Use or purchase of medication; 33 (e) Bodily functions, vital signs, symptoms, or measurements of 34 the information described in this subsection; 35 (f) Diagnoses or diagnostic testing, treatment, or medication; 36 (g) Reproductive health care services; or 37 (h) Gender-affirming care services. 38 (15) "Homepage" means the introductory page of an internet 39 website and any internet webpage where personal information is 40 p. 5 HB 1155 collected. In the case of an online service, such as a mobile 1 application, homepage means the application's platform page or 2 download page, and a link within the application, such as from the 3 application configuration, "about," "information," or settings page. 4 (16) "Person" shall include, where applicable, natural persons, 5 corporations, trusts, unincorporated associations, and partnerships. 6 (17)(a) "Personal information" means information that identifies, 7 relates to, describes, or is reasonably capable of being associated 8 or linked, directly or indirectly, with a particular consumer. 9 "Personal information" includes, but is not limited to, data 10 associated with a persistent unique identifier, such as a cookie ID, 11 an IP address, a device identifier, or any other form of persistent 12 unique identifier. 13 (b) "Personal information" does not include publicly available 14 information. For purposes of this subsection, "publicly available" 15 means information that is lawfully made available from federal, 16 state, or local government records. Any biometric data collected 17 about a consumer by a business without the consumer's knowledge is 18 not publicly available information. 19 (c) "Personal information" does not include deidentified data. 20 (18) "Process" or "processing" means any operation or set of 21 operations performed on consumer health data. 22 (19) "Regulated entity" means any legal entity that (a) conducts 23 business in Washington, or produces or provides products or services 24 that are targeted to consumers in Washington; (b) collects, shares, 25 or sells consumer health data; and (c) determines the purpose and 26 means of the processing of consumer health data. "Regulated entity" 27 does not mean government agencies or tribal nations. 28 (20) "Reproductive or sexual health information" means personal 29 information relating to seeking or obtaining past, present, or future 30 reproductive or sexual health services. "Reproductive or sexual 31 health information" includes, but is not limited to: 32 (a) Location information that could reasonably indicate a 33 consumer's attempt to acquire or receive reproductive or sexual 34 health services; 35 (b) Efforts to research or obtain reproductive or sexual health 36 services; or 37 (c) Any reproductive or sexual health information that is 38 derived, extrapolated, or inferred, including from nonhealth 39 p. 6 HB 1155 information (such as proxy, derivative, inferred, emergent, or 1 algorithmic data). 2 (21) "Reproductive or sexual health services" means health 3 services or products that support or relate to an individual's 4 reproductive system or sexual well-being, including but not limited 5 to: 6 (a) Individual health conditions, status, diseases, or diagnoses; 7 (b) Social, psychological, behavioral, and medical interventions; 8 (c) Health-related surgeries or procedures including, but not 9 limited to, abortions; 10 (d) Use or purchase of medication including, but not limited to, 11 medications for the purposes of abortion; 12 (e) Bodily functions, vital signs, symptoms, or measurements of 13 the information described in this subsection; 14 (f) Diagnoses or diagnostic testing, treatment, or medication; 15 and 16 (g) Medical or nonmedical services related to and provided in 17 conjunction with an abortion, including but not limited to associated 18 diagnostics, counseling, supplies, and follow-up services. 19 (22)(a) "Sell" or "sale" means the sharing of consumer health 20 data for monetary or other valuable consideration. 21 (b) "Sell" or "sale" does not include the sharing of consumer 22 health data for monetary or other valuable consideration: 23 (i) To a third party as an asset that is part of a merger, 24 acquisition, bankruptcy, or other transaction in which the third 25 party assumes control of all or part of the regulated entity's assets 26 that shall comply with the requirements and obligations in this 27 chapter; 28 (ii) By a natural person selling their own consumer health data 29 pursuant to a written contract of sale with a third party; or 30 (iii) By a regulated entity to a service provider when such 31 sharing is consistent with the purpose for which the consumer health 32 data was collected and disclosed to the consumer. 33 (23) "Service provider" means a person that processes consumer 34 health data on behalf of a regulated entity. 35 (24)(a) "Share" or "sharing" means to release, disclose, 36 disseminate, divulge, make available, provide access to, license, or 37 otherwise communicate orally, in writing, or by electronic or other 38 means, consumer health data by a regulated entity to a third party or 39 affiliate. 40 p. 7 HB 1155 (b) The term "share" or "sharing" does not include: 1 (i) The disclosure of consumer health data by a regulated entity 2 to a service provider when such sharing is consistent with the 3 purpose for which the consumer health data was collected and 4 disclosed to the consumer; 5 (ii) The disclosure of consumer health data to a third party with 6 whom the consumer has a direct relationship when: (A) The disclosure 7 is for purposes of providing a product or service requested by the 8 consumer; (B) the regulated entity maintains control and ownership of 9 the data; and (C) the third party uses the consumer health data only 10 at direction from the regulated entity and consistent with the 11 purpose for which it was collected and disclosed to the consumer; or 12 (iii) The disclosure or transfer of personal data to a third 13 party as an asset that is part of a merger, acquisition, bankruptcy, 14 or other transaction in which the third party assumes control of all 15 or part of the regulated entity's assets and shall comply with the 16 requirements and obligations in this chapter. 17 (25) "Third party" means an entity other than a consumer, 18 regulated entity, service provider, or affiliate of the regulated 19 entity. 20 NEW SECTION. Sec. 4. (1) A regulated entity shall maintain a 21 consumer health data privacy policy that clearly and conspicuously 22 discloses: 23 (a) The specific types of consumer health data collected and the 24 purpose for which the data is collected, including the specific ways 25 in which it will be used; 26 (b) The sources from which the consumer health data is collected; 27 (c) The specific consumer health data that is shared; 28 (d) A list of third parties and affiliates with whom the 29 regulated entity shares the consumer health data, including an active 30 email address or other online mechanism that the consumer may use to 31 contact these third parties and affiliates; and 32 (e) How a consumer can exercise the rights provided in section 6 33 of this act. 34 (2) A regulated entity shall prominently publish its consumer 35 health data privacy policy on its homepage. 36 (3) A regulated entity may not collect, use, or share additional 37 categories of consumer health data not disclosed in the consumer 38 health data privacy policy without first disclosing the additional 39 p. 8 HB 1155 categories and obtaining the consumer's affirmative consent prior to 1 the collection, use, or sharing of such consumer health data. 2 (4) A regulated entity may not collect, use, or share consumer 3 health data for additional purposes not disclosed in the consumer 4 health data privacy policy without first disclosing the additional 5 purposes and obtaining the consumer's affirmative consent prior to 6 the collection, use, or sharing of such consumer health data. 7 (5) It is a violation of this chapter for a regulated entity to 8 contract with a service provider to process consumer health data in a 9 manner that is inconsistent with the regulated entity's consumer 10 health data privacy policy. 11 NEW SECTION. Sec. 5. (1) A regulated entity may not collect any 12 consumer health data except: 13 (a) With consent from the consumer for such collection for a 14 specified purpose; or 15 (b) To the extent strictly necessary to provide a product or 16 service that the consumer to whom such consumer health data relates 17 has requested from such regulated entity. 18 (2) A regulated entity may not share any consumer health data 19 except: 20 (a) With consent from the consumer for such sharing that is 21 separate and distinct from the consent obtained to collect consumer 22 health data; or 23 (b) To the extent strictly necessary to provide a product or 24 service that the consumer to whom such consumer health data relates 25 has requested from such regulated entity. 26 (3) Consent required under this section must be obtained prior to 27 the collection or sharing, as applicable, of any consumer health 28 data, and the request for consent must clearly and conspicuously 29 disclose: (a) The categories of consumer health data collected or 30 shared; (b) the purpose of the collection or sharing of the consumer 31 health data, including the specific ways in which it will be used; 32 (c) the entities with whom the consumer health data is shared; and 33 (d) how the consumer can withdraw consent from future collection or 34 sharing of the consumer's health data. 35 (4) A regulated entity may not discriminate against a consumer 36 for exercising any rights included in this chapter. 37 p. 9 HB 1155 NEW SECTION. Sec. 6. (1) A consumer has the right to confirm 1 whether a regulated entity is collecting or sharing consumer health 2 data concerning the consumer and to access such data. 3 (2) A consumer has the right to confirm that a regulated entity 4 has not sold consumer health data concerning the consumer. 5 (3) A consumer has the right to withdraw consent from the 6 regulated entity's collection and sharing of consumer health data 7 concerning the consumer. 8 (4) A consumer has the right to have consumer health data 9 concerning the consumer deleted and may exercise that right by 10 informing the regulated entity of the consumer's request for 11 deletion. 12 (a) A regulated entity that receives a consumer's request to 13 delete any consumer health data concerning the consumer shall without 14 unreasonable delay and no more than 30 calendar days from receiving 15 the deletion request: 16 (i) Delete the consumer health data from its records, including 17 from all parts of the regulated entity's network or backup systems; 18 and 19 (ii) Notify all affiliates, service providers, contractors, and 20 other third parties with whom the regulated entity has shared 21 consumer health data of the deletion request. 22 (b) All affiliates, service providers, contractors, and other 23 third parties that receive notice of a consumer's deletion request 24 shall honor the consumer's deletion request and delete the consumer 25 health data from its records, including from all parts of its network 26 or backup systems. 27 (5) A consumer may exercise the rights set forth in this chapter 28 by submitting a request, at any time, to a regulated entity. Such a 29 request may be made by contacting the regulated entity through the 30 manner included in its consumer health data privacy policy. 31 NEW SECTION. Sec. 7. (1) A regulated entity shall restrict 32 access to consumer health data by the employees, service providers, 33 and contractors of such regulated entity to only those employees, 34 service providers, and contractors for which access is necessary to 35 further the purposes for which the consumer provided consent or where 36 strictly necessary to provide a product or service that the consumer 37 to whom such data and information relates has requested from such 38 regulated entity. 39 p. 10 HB 1155 (2) A regulated entity shall establish, implement, and maintain 1 administrative, technical, and physical data security practices that, 2 at a minimum, satisfy reasonable standard of care within the 3 regulated entity's industry to protect the confidentiality, 4 integrity, and accessibility of consumer health data appropriate to 5 the volume and nature of the personal data at issue. 6 NEW SECTION. Sec. 8. (1)(a) A service provider may process 7 consumer health data only pursuant to a binding contract between the 8 service provider and the regulated entity that sets forth the 9 processing instructions and limit the actions the service provider 10 may take with respect to the consumer health data it processes on 11 behalf of the regulated entity. 12 (b) A service provider may process consumer health data only in a 13 manner that is consistent with the binding instructions set forth in 14 the contract with the regulated entity. 15 (2) A service provider shall assist the regulated entity by 16 appropriate technical and organizational measures, insofar as this is 17 possible, in fulfilling the regulated entity's obligations under this 18 chapter. 19 (3) If a service provider fails to adhere to the regulated 20 entity's instructions or processes consumer health data in a manner 21 that is outside the scope of the service provider's contract with the 22 regulated entity, the service provider is considered a regulated 23 entity and is subject to all the requirements of this chapter. 24 NEW SECTION. Sec. 9. It is unlawful for any person including, 25 but not limited to, regulated entities or service providers, to sell 26 consumer health data. 27 NEW SECTION. Sec. 10. It is unlawful for any person to 28 implement a geofence around any entity that provides in-person health 29 care services where such geofence is used to identify, track, collect 30 data from, or send notifications or messages to a consumer that 31 enters the virtual perimeter. 32 NEW SECTION. Sec. 11. The legislature finds that the practices 33 covered by this chapter are matters vitally affecting the public 34 interest for the purpose of applying the consumer protection act, 35 chapter 19.86 RCW. A violation of this chapter is not reasonable in 36 p. 11 HB 1155 relation to the development and preservation of business, and is an 1 unfair or deceptive act in trade or commerce and an unfair method of 2 competition for the purpose of applying the consumer protection act, 3 chapter 19.86 RCW. 4 NEW SECTION. Sec. 12. (1) This chapter does not apply to: 5 (a) Protected health information, or information treated like 6 protected health information, collected, used, or disclosed by 7 covered entities and business associates when: (i) The protected 8 health information is collected, used, or disclosed in accordance 9 with the federal health insurance portability and accountability act 10 of 1996 and the health information technology for economic and 11 clinical health act, 45 C.F.R. Parts 160 and 164, and its 12 implementing regulations; and (ii) the protected health information 13 is afforded all the privacy protections and security safeguards of 14 those federal laws and their implementing regulations. For the 15 purpose of this subsection (1), "protected health information," 16 "covered entity," and "business associate" have the same meaning as 17 in the federal health insurance portability and accountability act of 18 1996 and its implementing regulations; 19 (b) Patient identifying information collected, used, or disclosed 20 in accordance with 42 C.F.R. Part 2, established pursuant to 42 21 U.S.C. Sec. 290dd-2; or 22 (c) Health care information collected, used, or disclosed in 23 accordance with chapter 70.02 RCW. 24 (2) Nothing in this chapter shall be construed to prohibit 25 disclosure as required under chapters 26.44 and 74.34 RCW. 26 NEW SECTION. Sec. 13. If any provision of this act or its 27 application to any person or circumstance is held invalid, the 28 remainder of the act or the application of the provision to other 29 persons or circumstances is not affected. 30 NEW SECTION. Sec. 14. Sections 1 through 12 of this act 31 constitute a new chapter in Title 19 RCW. 32 --- END --- p. 12 HB 1155

CERTIFICATION OF ENROLLMENT ENGROSSED SUBSTITUTE HOUSE BILL 1155 Chapter 191, Laws of 2023 68th Legislature 2023 Regular Session CONSUMER HEALTH DATA EFFECTIVE DATE: July 23, 2023 Passed by the House April 17, 2023 Yeas 57 Nays 40 LAURIE JINKINS Speaker of the House of Representatives Passed by the Senate April 5, 2023 Yeas 27 Nays 21 DENNY HECK President of the Senate CERTIFICATE I, Bernard Dean, Chief Clerk of the House of Representatives of the State of Washington, do hereby certify that the attached is ENGROSSED SUBSTITUTE HOUSE BILL 1155 as passed by the House of Representatives and the Senate on the dates hereon set forth. BERNARD DEAN Chief Clerk Approved April 27, 2023 10:05 AM FILED April 27, 2023 JAY INSLEE Governor of the State of Washington Secretary of State State of Washington AN ACT Relating to the collection, sharing, and selling of 1 consumer health data; adding a new section to chapter 44.28 RCW; 2 adding a new chapter to Title 19 RCW; and providing an expiration 3 date. 4 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON: 5 NEW SECTION. Sec. 1. This act may be known and cited as the 6 Washington my health my data act. 7 NEW SECTION. Sec. 2. (1) The legislature finds that the people 8 of Washington regard their privacy as a fundamental right and an 9 essential element of their individual freedom. Washington's 10 Constitution explicitly provides the right to privacy. Fundamental 11 privacy rights have long been and continue to be integral to 12 protecting Washingtonians and to safeguarding our democratic 13 republic. 14 (2) Information related to an individual's health conditions or 15 attempts to obtain health care services is among the most personal 16 and sensitive categories of data collected. Washingtonians expect 17 that their health data is protected under laws like the health 18 information portability and accountability act (HIPAA). However, 19 HIPAA only covers health data collected by specific health care 20 ENGROSSED SUBSTITUTE HOUSE BILL 1155 AS AMENDED BY THE SENATE Passed Legislature - 2023 Regular Session State of Washington 68th Legislature 2023 Regular Session By House Civil Rights & Judiciary (originally sponsored by Representatives Slatter, Street, Reed, Ryu, Berg, Alvarado, Taylor, Bateman, Ramel, Senn, Goodman, Fitzgibbon, Macri, Simmons, Reeves, Lekanoff, Orwall, Duerr, Thai, Gregerson, Wylie, Ortiz-Self, Stonier, Pollet, Riccelli, Donaghy, Fosse, and Ormsby; by request of Attorney General) READ FIRST TIME 02/07/23. p. 1 ESHB 1155.SL entities, including most health care providers. Health data collected 1 by noncovered entities, including certain apps and websites, are not 2 afforded the same protections. This act works to close the gap 3 between consumer knowledge and industry practice by providing 4 stronger privacy protections for all Washington consumers' health 5 data. 6 (3) With this act, the legislature intends to provide heightened 7 protections for Washingtonian's health data by: Requiring additional 8 disclosures and consumer consent regarding the collection, sharing, 9 and use of such information; empowering consumers with the right to 10 have their health data deleted; prohibiting the selling of consumer 11 health data without valid authorization signed by the consumer; and 12 making it unlawful to utilize a geofence around a facility that 13 provides health care services. 14 NEW SECTION. Sec. 3. The definitions in this section apply 15 throughout this chapter unless the context clearly requires 16 otherwise. 17 (1) "Abortion" means the termination of a pregnancy for purposes 18 other than producing a live birth. 19 (2) "Affiliate" means a legal entity that shares common branding 20 with another legal entity and controls, is controlled by, or is under 21 common control with another legal entity. For the purposes of this 22 definition, "control" or "controlled" means: 23 (a) Ownership of, or the power to vote, more than 50 percent of 24 the outstanding shares of any class of voting security of a company; 25 (b) Control in any manner over the election of a majority of the 26 directors or of individuals exercising similar functions; or 27 (c) The power to exercise controlling influence over the 28 management of a company. 29 (3) "Authenticate" means to use reasonable means to determine 30 that a request to exercise any of the rights afforded in this chapter 31 is being made by, or on behalf of, the consumer who is entitled to 32 exercise such consumer rights with respect to the consumer health 33 data at issue. 34 (4) "Biometric data" means data that is generated from the 35 measurement or technological processing of an individual's 36 physiological, biological, or behavioral characteristics and that 37 identifies a consumer, whether individually or in combination with 38 other data. Biometric data includes, but is not limited to: 39 p. 2 ESHB 1155.SL (a) Imagery of the iris, retina, fingerprint, face, hand, palm, 1 vein patterns, and voice recordings, from which an identifier 2 template can be extracted; or 3 (b) Keystroke patterns or rhythms and gait patterns or rhythms 4 that contain identifying information. 5 (5) "Collect" means to buy, rent, access, retain, receive, 6 acquire, infer, derive, or otherwise process consumer health data in 7 any manner. 8 (6)(a) "Consent" means a clear affirmative act that signifies a 9 consumer's freely given, specific, informed, opt-in, voluntary, and 10 unambiguous agreement, which may include written consent provided by 11 electronic means. 12 (b) "Consent" may not be obtained by: 13 (i) A consumer's acceptance of a general or broad terms of use 14 agreement or a similar document that contains descriptions of 15 personal data processing along with other unrelated information; 16 (ii) A consumer hovering over, muting, pausing, or closing a 17 given piece of content; or 18 (iii) A consumer's agreement obtained through the use of 19 deceptive designs. 20 (7) "Consumer" means (a) a natural person who is a Washington 21 resident; or (b) a natural person whose consumer health data is 22 collected in Washington. "Consumer" means a natural person who acts 23 only in an individual or household context, however identified, 24 including by any unique identifier. "Consumer" does not include an 25 individual acting in an employment context. 26 (8)(a) "Consumer health data" means personal information that is 27 linked or reasonably linkable to a consumer and that identifies the 28 consumer's past, present, or future physical or mental health status. 29 (b) For the purposes of this definition, physical or mental 30 health status includes, but is not limited to: 31 (i) Individual health conditions, treatment, diseases, or 32 diagnosis; 33 (ii) Social, psychological, behavioral, and medical 34 interventions; 35 (iii) Health-related surgeries or procedures; 36 (iv) Use or purchase of prescribed medication; 37 (v) Bodily functions, vital signs, symptoms, or measurements of 38 the information described in this subsection (8)(b); 39 (vi) Diagnoses or diagnostic testing, treatment, or medication; 40 p. 3 ESHB 1155.SL (vii) Gender-affirming care information; 1 (viii) Reproductive or sexual health information; 2 (ix) Biometric data; 3 (x) Genetic data; 4 (xi) Precise location information that could reasonably indicate 5 a consumer's attempt to acquire or receive health services or 6 supplies; 7 (xii) Data that identifies a consumer seeking health care 8 services; or 9 (xiii) Any information that a regulated entity or a small 10 business, or their respective processor, processes to associate or 11 identify a consumer with the data described in (b)(i) through (xii) 12 of this subsection that is derived or extrapolated from nonhealth 13 information (such as proxy, derivative, inferred, or emergent data by 14 any means, including algorithms or machine learning). 15 (c) "Consumer health data" does not include personal information 16 that is used to engage in public or peer-reviewed scientific, 17 historical, or statistical research in the public interest that 18 adheres to all other applicable ethics and privacy laws and is 19 approved, monitored, and governed by an institutional review board, 20 human subjects research ethics review board, or a similar independent 21 oversight entity that determines that the regulated entity or the 22 small business has implemented reasonable safeguards to mitigate 23 privacy risks associated with research, including any risks 24 associated with reidentification. 25 (9) "Deceptive design" means a user interface designed or 26 manipulated with the effect of subverting or impairing user autonomy, 27 decision making, or choice. 28 (10) "Deidentified data" means data that cannot reasonably be 29 used to infer information about, or otherwise be linked to, an 30 identified or identifiable consumer, or a device linked to such 31 consumer, if the regulated entity or the small business that 32 possesses such data (a) takes reasonable measures to ensure that such 33 data cannot be associated with a consumer; (b) publicly commits to 34 process such data only in a deidentified fashion and not attempt to 35 reidentify such data; and (c) contractually obligates any recipients 36 of such data to satisfy the criteria set forth in this subsection 37 (10). 38 (11) "Gender-affirming care information" means personal 39 information relating to seeking or obtaining past, present, or future 40 p. 4 ESHB 1155.SL gender-affirming care services. "Gender-affirming care information" 1 includes, but is not limited to: 2 (a) Precise location information that could reasonably indicate a 3 consumer's attempt to acquire or receive gender-affirming care 4 services; 5 (b) Efforts to research or obtain gender-affirming care services; 6 or 7 (c) Any gender-affirming care information that is derived, 8 extrapolated, or inferred, including from nonhealth information, such 9 as proxy, derivative, inferred, emergent, or algorithmic data. 10 (12) "Gender-affirming care services" means health services or 11 products that support and affirm an individual's gender identity 12 including, but not limited to, social, psychological, behavioral, 13 cosmetic, medical, or surgical interventions. "Gender-affirming care 14 services" includes, but is not limited to, treatments for gender 15 dysphoria, gender-affirming hormone therapy, and gender-affirming 16 surgical procedures. 17 (13) "Genetic data" means any data, regardless of its format, 18 that concerns a consumer's genetic characteristics. "Genetic data" 19 includes, but is not limited to: 20 (a) Raw sequence data that result from the sequencing of a 21 consumer's complete extracted deoxyribonucleic acid (DNA) or a 22 portion of the extracted DNA; 23 (b) Genotypic and phenotypic information that results from 24 analyzing the raw sequence data; and 25 (c) Self-reported health data that a consumer submits to a 26 regulated entity or a small business and that is analyzed in 27 connection with consumer's raw sequence data. 28 (14) "Geofence" means technology that uses global positioning 29 coordinates, cell tower connectivity, cellular data, radio frequency 30 identification, Wifi data, and/or any other form of spatial or 31 location detection to establish a virtual boundary around a specific 32 physical location, or to locate a consumer within a virtual boundary. 33 For purposes of this definition, "geofence" means a virtual boundary 34 that is 2,000 feet or less from the perimeter of the physical 35 location. 36 (15) "Health care services" means any service provided to a 37 person to assess, measure, improve, or learn about a person's mental 38 or physical health, including but not limited to: 39 (a) Individual health conditions, status, diseases, or diagnoses; 40 p. 5 ESHB 1155.SL (b) Social, psychological, behavioral, and medical interventions; 1 (c) Health-related surgeries or procedures; 2 (d) Use or purchase of medication; 3 (e) Bodily functions, vital signs, symptoms, or measurements of 4 the information described in this subsection; 5 (f) Diagnoses or diagnostic testing, treatment, or medication; 6 (g) Reproductive health care services; or 7 (h) Gender-affirming care services. 8 (16) "Homepage" means the introductory page of an internet 9 website and any internet webpage where personal information is 10 collected. In the case of an online service, such as a mobile 11 application, homepage means the application's platform page or 12 download page, and a link within the application, such as from the 13 application configuration, "about," "information," or settings page. 14 (17) "Person" means, where applicable, natural persons, 15 corporations, trusts, unincorporated associations, and partnerships. 16 "Person" does not include government agencies, tribal nations, or 17 contracted service providers when processing consumer health data on 18 behalf of a government agency. 19 (18)(a) "Personal information" means information that identifies 20 or is reasonably capable of being associated or linked, directly or 21 indirectly, with a particular consumer. "Personal information" 22 includes, but is not limited to, data associated with a persistent 23 unique identifier, such as a cookie ID, an IP address, a device 24 identifier, or any other form of persistent unique identifier. 25 (b) "Personal information" does not include publicly available 26 information. 27 (c) "Personal information" does not include deidentified data. 28 (19) "Precise location information" means information derived 29 from technology including, but not limited to, global positioning 30 system level latitude and longitude coordinates or other mechanisms, 31 that directly identifies the specific location of an individual with 32 precision and accuracy within a radius of 1,750 feet. "Precise 33 location information" does not include the content of communications, 34 or any data generated by or connected to advanced utility metering 35 infrastructure systems or equipment for use by a utility. 36 (20) "Process" or "processing" means any operation or set of 37 operations performed on consumer health data. 38 (21) "Processor" means a person that processes consumer health 39 data on behalf of a regulated entity or a small business. 40 p. 6 ESHB 1155.SL (22) "Publicly available information" means information that (a) 1 is lawfully made available through federal, state, or municipal 2 government records or widely distributed media, and (b) a regulated 3 entity or a small business has a reasonable basis to believe a 4 consumer has lawfully made available to the general public. "Publicly 5 available information" does not include any biometric data collected 6 about a consumer by a business without the consumer's consent. 7 (23) "Regulated entity" means any legal entity that: (a) Conducts 8 business in Washington, or produces or provides products or services 9 that are targeted to consumers in Washington; and (b) alone or 10 jointly with others, determines the purpose and means of collecting, 11 processing, sharing, or selling of consumer health data. "Regulated 12 entity" does not mean government agencies, tribal nations, or 13 contracted service providers when processing consumer health data on 14 behalf of the government agency. 15 (24) "Reproductive or sexual health information" means personal 16 information relating to seeking or obtaining past, present, or future 17 reproductive or sexual health services. "Reproductive or sexual 18 health information" includes, but is not limited to: 19 (a) Precise location information that could reasonably indicate a 20 consumer's attempt to acquire or receive reproductive or sexual 21 health services; 22 (b) Efforts to research or obtain reproductive or sexual health 23 services; or 24 (c) Any reproductive or sexual health information that is 25 derived, extrapolated, or inferred, including from nonhealth 26 information (such as proxy, derivative, inferred, emergent, or 27 algorithmic data). 28 (25) "Reproductive or sexual health services" means health 29 services or products that support or relate to a consumer's 30 reproductive system or sexual well-being, including but not limited 31 to: 32 (a) Individual health conditions, status, diseases, or diagnoses; 33 (b) Social, psychological, behavioral, and medical interventions; 34 (c) Health-related surgeries or procedures including, but not 35 limited to, abortions; 36 (d) Use or purchase of medication including, but not limited to, 37 medications for the purposes of abortion; 38 (e) Bodily functions, vital signs, symptoms, or measurements of 39 the information described in this subsection; 40 p. 7 ESHB 1155.SL (f) Diagnoses or diagnostic testing, treatment, or medication; 1 and 2 (g) Medical or nonmedical services related to and provided in 3 conjunction with an abortion, including but not limited to associated 4 diagnostics, counseling, supplies, and follow-up services. 5 (26)(a) "Sell" or "sale" means the exchange of consumer health 6 data for monetary or other valuable consideration. 7 (b) "Sell" or "sale" does not include the exchange of consumer 8 health data for monetary or other valuable consideration: 9 (i) To a third party as an asset that is part of a merger, 10 acquisition, bankruptcy, or other transaction in which the third 11 party assumes control of all or part of the regulated entity's or the 12 small business's assets that complies with the requirements and 13 obligations in this chapter; or 14 (ii) By a regulated entity or a small business to a processor 15 when such exchange is consistent with the purpose for which the 16 consumer health data was collected and disclosed to the consumer. 17 (27)(a) "Share" or "sharing" means to release, disclose, 18 disseminate, divulge, make available, provide access to, license, or 19 otherwise communicate orally, in writing, or by electronic or other 20 means, consumer health data by a regulated entity or a small business 21 to a third party or affiliate. 22 (b) The term "share" or "sharing" does not include: 23 (i) The disclosure of consumer health data by a regulated entity 24 or a small business to a processor when such sharing is to provide 25 goods or services in a manner consistent with the purpose for which 26 the consumer health data was collected and disclosed to the consumer; 27 (ii) The disclosure of consumer health data to a third party with 28 whom the consumer has a direct relationship when: (A) The disclosure 29 is for purposes of providing a product or service requested by the 30 consumer; (B) the regulated entity or the small business maintains 31 control and ownership of the data; and (C) the third party uses the 32 consumer health data only at direction from the regulated entity or 33 the small business and consistent with the purpose for which it was 34 collected and consented to by the consumer; or 35 (iii) The disclosure or transfer of personal data to a third 36 party as an asset that is part of a merger, acquisition, bankruptcy, 37 or other transaction in which the third party assumes control of all 38 or part of the regulated entity's or the small business's assets and 39 complies with the requirements and obligations in this chapter. 40 p. 8 ESHB 1155.SL (28) "Small business" means a regulated entity that satisfies one 1 or both of the following thresholds: 2 (a) Collects, processes, sells, or shares consumer health data of 3 fewer than 100,000 consumers during a calendar year; or 4 (b) Derives less than 50 percent of gross revenue from the 5 collection, processing, selling, or sharing of consumer health data, 6 and controls, processes, sells, or shares consumer health data of 7 fewer than 25,000 consumers. 8 (29) "Third party" means an entity other than a consumer, 9 regulated entity, processor, small business, or affiliate of the 10 regulated entity or the small business. 11 NEW SECTION. Sec. 4. (1)(a) Except as provided in subsection 12 (2) of this section, beginning March 31, 2024, a regulated entity and 13 a small business shall maintain a consumer health data privacy policy 14 that clearly and conspicuously discloses: 15 (i) The categories of consumer health data collected and the 16 purpose for which the data is collected, including how the data will 17 be used; 18 (ii) The categories of sources from which the consumer health 19 data is collected; 20 (iii) The categories of consumer health data that is shared; 21 (iv) A list of the categories of third parties and specific 22 affiliates with whom the regulated entity or the small business 23 shares the consumer health data; and 24 (v) How a consumer can exercise the rights provided in section 6 25 of this act. 26 (b) A regulated entity and a small business shall prominently 27 publish a link to its consumer health data privacy policy on its 28 homepage. 29 (c) A regulated entity or a small business may not collect, use, 30 or share additional categories of consumer health data not disclosed 31 in the consumer health data privacy policy without first disclosing 32 the additional categories and obtaining the consumer's affirmative 33 consent prior to the collection, use, or sharing of such consumer 34 health data. 35 (d) A regulated entity or a small business may not collect, use, 36 or share consumer health data for additional purposes not disclosed 37 in the consumer health data privacy policy without first disclosing 38 the additional purposes and obtaining the consumer's affirmative 39 p. 9 ESHB 1155.SL consent prior to the collection, use, or sharing of such consumer 1 health data. 2 (e) It is a violation of this chapter for a regulated entity or a 3 small business to contract with a processor to process consumer 4 health data in a manner that is inconsistent with the regulated 5 entity's or the small business's consumer health data privacy policy. 6 (2) A small business must comply with this section beginning June 7 30, 2024. 8 NEW SECTION. Sec. 5. (1)(a) Except as provided in subsection 9 (2) of this section, beginning March 31, 2024, a regulated entity or 10 a small business may not collect any consumer health data except: 11 (i) With consent from the consumer for such collection for a 12 specified purpose; or 13 (ii) To the extent necessary to provide a product or service that 14 the consumer to whom such consumer health data relates has requested 15 from such regulated entity or small business. 16 (b) A regulated entity or a small business may not share any 17 consumer health data except: 18 (i) With consent from the consumer for such sharing that is 19 separate and distinct from the consent obtained to collect consumer 20 health data; or 21 (ii) To the extent necessary to provide a product or service that 22 the consumer to whom such consumer health data relates has requested 23 from such regulated entity or small business. 24 (c) Consent required under this section must be obtained prior to 25 the collection or sharing, as applicable, of any consumer health 26 data, and the request for consent must clearly and conspicuously 27 disclose: (i) The categories of consumer health data collected or 28 shared; (ii) the purpose of the collection or sharing of the consumer 29 health data, including the specific ways in which it will be used; 30 (iii) the categories of entities with whom the consumer health data 31 is shared; and (iv) how the consumer can withdraw consent from future 32 collection or sharing of the consumer's health data. 33 (d) A regulated entity or a small business may not unlawfully 34 discriminate against a consumer for exercising any rights included in 35 this chapter. 36 (2) A small business must comply with this section beginning June 37 30, 2024. 38 p. 10 ESHB 1155.SL NEW SECTION. Sec. 6. (1)(a) Except as provided in subsection 1 (2) of this section, beginning March 31, 2024, a consumer has the 2 right to confirm whether a regulated entity or a small business is 3 collecting, sharing, or selling consumer health data concerning the 4 consumer and to access such data, including a list of all third 5 parties and affiliates with whom the regulated entity or the small 6 business has shared or sold the consumer health data and an active 7 email address or other online mechanism that the consumer may use to 8 contact these third parties. 9 (b) A consumer has the right to withdraw consent from the 10 regulated entity's or the small business's collection and sharing of 11 consumer health data concerning the consumer. 12 (c) A consumer has the right to have consumer health data 13 concerning the consumer deleted and may exercise that right by 14 informing the regulated entity or the small business of the 15 consumer's request for deletion. 16 (i) A regulated entity or a small business that receives a 17 consumer's request to delete any consumer health data concerning the 18 consumer shall: 19 (A) Delete the consumer health data from its records, including 20 from all parts of the regulated entity's or the small business's 21 network, including archived or backup systems pursuant to (c)(iii) of 22 this subsection; and 23 (B) Notify all affiliates, processors, contractors, and other 24 third parties with whom the regulated entity or the small business 25 has shared consumer health data of the deletion request. 26 (ii) All affiliates, processors, contractors, and other third 27 parties that receive notice of a consumer's deletion request shall 28 honor the consumer's deletion request and delete the consumer health 29 data from its records, subject to the same requirements of this 30 chapter. 31 (iii) If consumer health data that a consumer requests to be 32 deleted is stored on archived or backup systems, then the request for 33 deletion may be delayed to enable restoration of the archived or 34 backup systems and such delay may not exceed six months from 35 authenticating the deletion request. 36 (d) A consumer may exercise the rights set forth in this chapter 37 by submitting a request, at any time, to a regulated entity or a 38 small business. Such a request may be made by a secure and reliable 39 means established by the regulated entity or the small business and 40 p. 11 ESHB 1155.SL described in its consumer health data privacy policy. The method must 1 take into account the ways in which consumers normally interact with 2 the regulated entity or the small business, the need for secure and 3 reliable communication of such requests, and the ability of the 4 regulated entity or the small business to authenticate the identity 5 of the consumer making the request. A regulated entity or a small 6 business may not require a consumer to create a new account in order 7 to exercise consumer rights pursuant to this chapter but may require 8 a consumer to use an existing account. 9 (e) If a regulated entity or a small business is unable to 10 authenticate the request using commercially reasonable efforts, the 11 regulated entity or the small business is not required to comply with 12 a request to initiate an action under this section and may request 13 that the consumer provide additional information reasonably necessary 14 to authenticate the consumer and the consumer's request. 15 (f) Information provided in response to a consumer request must 16 be provided by a regulated entity and a small business free of 17 charge, up to twice annually per consumer. If requests from a 18 consumer are manifestly unfounded, excessive, or repetitive, the 19 regulated entity or the small business may charge the consumer a 20 reasonable fee to cover the administrative costs of complying with 21 the request or decline to act on the request. The regulated entity 22 and the small business bear the burden of demonstrating the 23 manifestly unfounded, excessive, or repetitive nature of the request. 24 (g) A regulated entity and a small business shall comply with the 25 consumer's requests under subsection (1)(a) through (c) of this 26 section without undue delay, but in all cases within 45 days of 27 receipt of the request submitted pursuant to the methods described in 28 this section. A regulated entity and a small business must promptly 29 take steps to authenticate a consumer request but this does not 30 extend the regulated entity's and the small business's duty to comply 31 with the consumer's request within 45 days of receipt of the 32 consumer's request. The response period may be extended once by 45 33 additional days when reasonably necessary, taking into account the 34 complexity and number of the consumer's requests, so long as the 35 regulated entity or the small business informs the consumer of any 36 such extension within the initial 45-day response period, together 37 with the reason for the extension. 38 (h) A regulated entity and a small business shall establish a 39 process for a consumer to appeal the regulated entity's or the small 40 p. 12 ESHB 1155.SL business's refusal to take action on a request within a reasonable 1 period of time after the consumer's receipt of the decision. The 2 appeal process must be conspicuously available and similar to the 3 process for submitting requests to initiate action pursuant to this 4 section. Within 45 days of receipt of an appeal, a regulated entity 5 or a small business shall inform the consumer in writing of any 6 action taken or not taken in response to the appeal, including a 7 written explanation of the reasons for the decisions. If the appeal 8 is denied, the regulated entity or the small business shall also 9 provide the consumer with an online mechanism, if available, or other 10 method through which the consumer may contact the attorney general to 11 submit a complaint. 12 (2) A small business must comply with this section beginning June 13 30, 2024. 14 NEW SECTION. Sec. 7. (1) Except as provided in subsection (2) 15 of this section, beginning March 31, 2024, a regulated entity and a 16 small business shall: 17 (a) Restrict access to consumer health data by the employees, 18 processors, and contractors of such regulated entity or small 19 business to only those employees, processors, and contractors for 20 which access is necessary to further the purposes for which the 21 consumer provided consent or where necessary to provide a product or 22 service that the consumer to whom such consumer health data relates 23 has requested from such regulated entity or small business; and 24 (b) Establish, implement, and maintain administrative, technical, 25 and physical data security practices that, at a minimum, satisfy 26 reasonable standard of care within the regulated entity's or the 27 small business's industry to protect the confidentiality, integrity, 28 and accessibility of consumer health data appropriate to the volume 29 and nature of the consumer health data at issue. 30 (2) A small business must comply with this section beginning June 31 30, 2024. 32 NEW SECTION. Sec. 8. (1)(a)(i) Except as provided in subsection 33 (2) of this section, beginning March 31, 2024, a processor may 34 process consumer health data only pursuant to a binding contract 35 between the processor and the regulated entity or the small business 36 that sets forth the processing instructions and limit the actions the 37 p. 13 ESHB 1155.SL processor may take with respect to the consumer health data it 1 processes on behalf of the regulated entity or the small business. 2 (ii) A processor may process consumer health data only in a 3 manner that is consistent with the binding instructions set forth in 4 the contract with the regulated entity or the small business. 5 (b) A processor shall assist the regulated entity or the small 6 business by appropriate technical and organizational measures, 7 insofar as this is possible, in fulfilling the regulated entity's and 8 the small business's obligations under this chapter. 9 (c) If a processor fails to adhere to the regulated entity's or 10 the small business's instructions or processes consumer health data 11 in a manner that is outside the scope of the processor's contract 12 with the regulated entity or the small business, the processor is 13 considered a regulated entity or a small business with regard to such 14 data and is subject to all the requirements of this chapter with 15 regard to such data. 16 (2) A small business must comply with this section beginning June 17 30, 2024. 18 NEW SECTION. Sec. 9. (1) Except as provided in subsection (6) 19 of this section, beginning March 31, 2024, it is unlawful for any 20 person to sell or offer to sell consumer health data concerning a 21 consumer without first obtaining valid authorization from the 22 consumer. The sale of consumer health data must be consistent with 23 the valid authorization signed by the consumer. This authorization 24 must be separate and distinct from the consent obtained to collect or 25 share consumer health data, as required under section 5 of this act. 26 (2) A valid authorization to sell consumer health data is a 27 document consistent with this section and must be written in plain 28 language. The valid authorization to sell consumer health data must 29 contain the following: 30 (a) The specific consumer health data concerning the consumer 31 that the person intends to sell; 32 (b) The name and contact information of the person collecting and 33 selling the consumer health data; 34 (c) The name and contact information of the person purchasing the 35 consumer health data from the seller identified in (b) of this 36 subsection; 37 p. 14 ESHB 1155.SL (d) A description of the purpose for the sale, including how the 1 consumer health data will be gathered and how it will be used by the 2 purchaser identified in (c) of this subsection when sold; 3 (e) A statement that the provision of goods or services may not 4 be conditioned on the consumer signing the valid authorization; 5 (f) A statement that the consumer has a right to revoke the valid 6 authorization at any time and a description on how to submit a 7 revocation of the valid authorization; 8 (g) A statement that the consumer health data sold pursuant to 9 the valid authorization may be subject to redisclosure by the 10 purchaser and may no longer be protected by this section; 11 (h) An expiration date for the valid authorization that expires 12 one year from when the consumer signs the valid authorization; and 13 (i) The signature of the consumer and date. 14 (3) An authorization is not valid if the document has any of the 15 following defects: 16 (a) The expiration date has passed; 17 (b) The authorization does not contain all the information 18 required under this section; 19 (c) The authorization has been revoked by the consumer; 20 (d) The authorization has been combined with other documents to 21 create a compound authorization; or 22 (e) The provision of goods or services is conditioned on the 23 consumer signing the authorization. 24 (4) A copy of the signed valid authorization must be provided to 25 the consumer. 26 (5) The seller and purchaser of consumer health data must retain 27 a copy of all valid authorizations for sale of consumer health data 28 for six years from the date of its signature or the date when it was 29 last in effect, whichever is later. 30 (6) A small business must comply with this section beginning June 31 30, 2024. 32 NEW SECTION. Sec. 10. It is unlawful for any person to 33 implement a geofence around an entity that provides in-person health 34 care services where such geofence is used to: (1) Identify or track 35 consumers seeking health care services; (2) collect consumer health 36 data from consumers; or (3) send notifications, messages, or 37 advertisements to consumers related to their consumer health data or 38 health care services. 39 p. 15 ESHB 1155.SL NEW SECTION. Sec. 11. The legislature finds that the practices 1 covered by this chapter are matters vitally affecting the public 2 interest for the purpose of applying the consumer protection act, 3 chapter 19.86 RCW. A violation of this chapter is not reasonable in 4 relation to the development and preservation of business, and is an 5 unfair or deceptive act in trade or commerce and an unfair method of 6 competition for the purpose of applying the consumer protection act, 7 chapter 19.86 RCW. 8 NEW SECTION. Sec. 12. (1) This chapter does not apply to: 9 (a) Information that meets the definition of: 10 (i) Protected health information for purposes of the federal 11 health insurance portability and accountability act of 1996 and 12 related regulations; 13 (ii) Health care information collected, used, or disclosed in 14 accordance with chapter 70.02 RCW; 15 (iii) Patient identifying information collected, used, or 16 disclosed in accordance with 42 C.F.R. Part 2, established pursuant 17 to 42 U.S.C. Sec. 290dd-2; 18 (iv) Identifiable private information for purposes of the federal 19 policy for the protection of human subjects, 45 C.F.R. Part 46; 20 identifiable private information that is otherwise information 21 collected as part of human subjects research pursuant to the good 22 clinical practice guidelines issued by the international council for 23 harmonization; the protection of human subjects under 21 C.F.R. Parts 24 50 and 56; or personal data used or shared in research conducted in 25 accordance with one or more of the requirements set forth in this 26 subsection; 27 (v) Information and documents created specifically for, and 28 collected and maintained by: 29 (A) A quality improvement committee for purposes of RCW 30 43.70.510, 70.230.080, or 70.41.200; 31 (B) A peer review committee for purposes of RCW 4.24.250; 32 (C) A quality assurance committee for purposes of RCW 74.42.640 33 or 18.20.390; 34 (D) A hospital, as defined in RCW 43.70.056, for reporting of 35 health care-associated infections for purposes of RCW 43.70.056, a 36 notification of an incident for purposes of RCW 70.56.040(5), or 37 reports regarding adverse events for purposes of RCW 70.56.020(2)(b); 38 or 39 p. 16 ESHB 1155.SL (E) A manufacturer, as defined in 21 C.F.R. Sec. 820.3(o), when 1 collected, used, or disclosed for purposes specified in chapter 70.02 2 RCW; 3 (vi) Information and documents created for purposes of the 4 federal health care quality improvement act of 1986, and related 5 regulations; 6 (vii) Patient safety work product for purposes of 42 C.F.R. Part 7 3, established pursuant to 42 U.S.C. Sec. 299b-21 through 299b-26; 8 (viii) Information that is (A) deidentified in accordance with 9 the requirements for deidentification set forth in 45 C.F.R. Part 10 164, and (B) derived from any of the health care-related information 11 listed in this subsection (1)(a)(viii); 12 (b) Information originating from, and intermingled to be 13 indistinguishable with, information under (a) of this subsection that 14 is maintained by: 15 (i) A covered entity or business associate as defined by the 16 health insurance portability and accountability act of 1996 and 17 related regulations; 18 (ii) A health care facility or health care provider as defined in 19 RCW 70.02.010; or 20 (iii) A program or a qualified service organization as defined by 21 42 C.F.R. Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2; 22 (c) Information used only for public health activities and 23 purposes as described in 45 C.F.R. Sec. 164.512 or that is part of a 24 limited data set, as defined, and is used, disclosed, and maintained 25 in the manner required, by 45 C.F.R. Sec. 164.514; or 26 (d) Identifiable data collected, used, or disclosed in accordance 27 with chapter 43.371 RCW or RCW 69.43.165. 28 (2) Personal information that is governed by and collected, used, 29 or disclosed pursuant to the following regulations, parts, titles, or 30 acts, is exempt from this chapter: (a) The Gramm-Leach-Bliley act (15 31 U.S.C. 6801 et seq.) and implementing regulations; (b) part C of 32 Title XI of the social security act (42 U.S.C. 1320d et seq.); (c) 33 the fair credit reporting act (15 U.S.C. 1681 et seq.); (d) the 34 family educational rights and privacy act (20 U.S.C. 1232g; Part 99 35 of Title 34, C.F.R.); (e) the Washington health benefit exchange and 36 applicable statutes and regulations, including 45 C.F.R. Sec. 155.260 37 and chapter 43.71 RCW; or (f) privacy rules adopted by the office of 38 the insurance commissioner pursuant to chapter 48.02 or 48.43 RCW. 39 p. 17 ESHB 1155.SL (3) The obligations imposed on regulated entities, small 1 businesses, and processors under this chapter does not restrict a 2 regulated entity's, small business's, or processor's ability for 3 collection, use, or disclosure of consumer health data to prevent, 4 detect, protect against, or respond to security incidents, identity 5 theft, fraud, harassment, malicious or deceptive activities, or any 6 activity that is illegal under Washington state law or federal law; 7 preserve the integrity or security of systems; or investigate, 8 report, or prosecute those responsible for any such action that is 9 illegal under Washington state law or federal law. 10 (4) If a regulated entity, small business, or processor processes 11 consumer health data pursuant to subsection (3) of this section, such 12 entity bears the burden of demonstrating that such processing 13 qualifies for the exemption and complies with the requirements of 14 this section. 15 NEW SECTION. Sec. 13. A new section is added to chapter 44.28 16 RCW to read as follows: 17 (1) The joint committee must review enforcement actions, as 18 authorized in section 11 of this act, brought by the attorney general 19 and consumers to enforce violations of this act. 20 (2) The report must include, at a minimum: 21 (a) The number of enforcement actions reported by the attorney 22 general, a consumer, a regulated entity, or a small business that 23 resulted in a settlement, including the average settlement amount; 24 (b) The number of complaints reported, including categories of 25 complaints and the number of complaints for each category, reported 26 by the attorney general, a consumer, a regulated entity, or a small 27 business; 28 (c) The number of enforcement actions brought by the attorney 29 general and consumers, including the categories of violations and the 30 number of violations per category; 31 (e) The number of civil actions where a judge determined the 32 position of the nonprevailing party was frivolous, if any; 33 (f) The types of resources, including associated costs, expended 34 by the attorney general, a consumer, a regulated entity, or a small 35 business for enforcement actions; and 36 (g) Recommendations for potential changes to enforcement 37 provisions of this act. 38 p. 18 ESHB 1155.SL (3) The office of the attorney general shall provide the joint 1 committee any data within their purview that the joint committee 2 considers necessary to conduct the review. 3 (4) The joint committee shall submit a report of its findings and 4 recommendations to the governor and the appropriate committees of the 5 legislature by September 30, 2030. 6 (5) This section expires June 30, 2031. 7 NEW SECTION. Sec. 14. If any provision of this act or its 8 application to any person or circumstance is held invalid, the 9 remainder of the act or the application of the provision to other 10 persons or circumstances is not affected. 11 NEW SECTION. Sec. 15. Sections 1 through 12 of this act 12 constitute a new chapter in Title 19 RCW. 13 Passed by the House April 17, 2023. Passed by the Senate April 5, 2023. Approved by the Governor April 27, 2023. Filed in Office of Secretary of State April 27, 2023. --- END --- p. 19 ESHB 1155.SL