Text of WA SB 5351 (2024)

AN ACT Relating to the collection, sharing, and selling of 1 consumer health data; and adding a new chapter to Title 19 RCW. 2 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON: 3 NEW SECTION. Sec. 1. This act may be known and cited as the 4 Washington my health my data act. 5 NEW SECTION. Sec. 2. (1) The legislature finds that the people 6 of Washington regard their privacy as a fundamental right and an 7 essential element of their individual freedom. Washington's 8 Constitution explicitly provides the right to privacy. Fundamental 9 privacy rights have long been and continue to be integral to 10 protecting Washingtonians and to safeguarding our democratic 11 republic. 12 (2) Information related to an individual's health conditions or 13 attempts to obtain health care services is among the most personal 14 and sensitive categories of data collected. Washingtonians expect 15 that their health data is protected under laws like the health 16 information portability and accountability act (HIPAA). However, 17 HIPAA only covers health data collected by specific health care 18 entities, including most health care providers. Health data collected 19 by noncovered entities, including certain apps and websites, are not 20 Z-0302.1 SENATE BILL 5351 State of Washington 68th Legislature 2023 Regular Session By Senator Dhingra; by request of Attorney General p. 1 SB 5351 afforded the same protections. This act works to close the gap 1 between consumer knowledge and industry practice by providing 2 stronger privacy protections for all Washington consumers' health 3 data. 4 (3) With this act, the legislature intends to provide heightened 5 protections for Washingtonian's health data by: Requiring additional 6 disclosures and consumer consent regarding the collection, sharing, 7 and use of such information; empowering consumers with the right to 8 have their health data deleted; prohibiting the selling of consumer 9 health data; and making it unlawful to utilize a geofence around a 10 facility that provides health care services. 11 NEW SECTION. Sec. 3. The definitions in this section apply 12 throughout this chapter unless the context clearly requires 13 otherwise. 14 (1) "Abortion" means the termination of a pregnancy for purposes 15 other than producing a live birth. 16 (2) "Affiliate" means a legal entity that shares common branding 17 with another legal entity and controls, is controlled by, or is under 18 common control with another legal entity. For the purposes of this 19 definition, "control" or "controlled" means: 20 (a) Ownership of, or the power to vote, more than 50 percent of 21 the outstanding shares of any class of voting security of a company; 22 (b) Control in any manner over the election of a majority of the 23 directors or of individuals exercising similar functions; or 24 (c) The power to exercise controlling influence over the 25 management of a company. 26 (3) "Biometric data" means data generated from the measurement or 27 technological processing of an individual's physiological, 28 biological, or behavioral characteristics that can be used 29 individually or in combination with other data to identify a 30 consumer. Biometric data includes, but is not limited to: 31 (a) Imagery of the iris, retina, fingerprint, face, hand, palm, 32 vein patterns, and voice recordings, from which an identifier 33 template can be extracted; or 34 (b) Keystroke patterns or rhythms, gait patterns or rhythms, and 35 sleep, health, or exercise data that contain identifying information. 36 (4) "Collect" means to buy, rent, access, retain, receive, 37 acquire, infer, derive, or otherwise process consumer health data in 38 any manner. 39 p. 2 SB 5351 (5)(a) "Consent" means a clear affirmative act by a consumer that 1 openly communicates a consumer's freely given, informed, opt-in, 2 voluntary, specific, and unambiguous written consent, which may 3 include written consent provided by electronic means. 4 (b) "Consent" cannot be obtained by: 5 (i) A consumer's acceptance of a general or broad terms of use 6 agreement or a similar document that contains descriptions of 7 personal data processing along with other unrelated information; 8 (ii) A consumer hovering over, muting, pausing, or closing a 9 given piece of content; or 10 (iii) A consumer's agreement obtained through the use of 11 deceptive designs. 12 (6) "Consumer" means (a) a natural person who is a Washington 13 resident; or (b) a natural person whose consumer health data is 14 collected in Washington. "Consumer" means a natural person who acts 15 only in an individual or household context, however identified, 16 including by any unique identifier. "Consumer" does not include an 17 individual acting in an employment context. 18 (7)(a) "Consumer health data" means personal information relating 19 to the past, present, or future physical or mental health of a 20 consumer including, but not limited to, any personal information 21 relating to: 22 (i) Individual health conditions, treatment, status, diseases, or 23 diagnoses; 24 (ii) Social, psychological, behavioral, and medical 25 interventions; 26 (iii) Health-related surgeries or procedures; 27 (iv) Use or purchase of medication; 28 (v) Bodily functions, vital signs, symptoms, or measurements of 29 the information described in this subsection; 30 (vi) Diagnoses or diagnostic testing, treatment, or medication; 31 (vii) Efforts to research or obtain health services or supplies; 32 (viii) Gender-affirming care information; 33 (ix) Reproductive or sexual health information; 34 (x) Biometric data related to information described in this 35 subsection (7)(a); 36 (xi) Genetic data related to information described in this 37 subsection (7)(a); 38 p. 3 SB 5351 (xii) Location information that could reasonably indicate a 1 consumer's attempt to acquire or receive health services or supplies; 2 or 3 (xiii) Any information described in (a)(i) through (xii) of this 4 subsection that is derived or extrapolated from nonhealth information 5 (such as proxy, derivative, inferred, or emergent data by any means, 6 including algorithms or machine learning). 7 (b) "Consumer health data" does not include personal information 8 that is used to engage in public or peer-reviewed scientific, 9 historical, or statistical research in the public interest that 10 adheres to all other applicable ethics and privacy laws and is 11 approved, monitored, and governed by an institutional review board, 12 human subjects research ethics review board, or a similar independent 13 oversight entity that determines that the regulated entity has 14 implemented reasonable safeguards to mitigate privacy risks 15 associated with research, including any risks associated with 16 reidentification. 17 (8) "Deceptive design" means a user interface designed or 18 manipulated with the potential effect of subverting or impairing user 19 autonomy, decision making, or choice. 20 (9) "Deidentified data" means data that cannot reasonably be used 21 to infer information about, or otherwise be linked to, an identified 22 or identifiable individual, or a device linked to such individual, if 23 the regulated entity that possesses such data (a) takes reasonable 24 measures to ensure that such data cannot be associated with an 25 individual; (b) publicly commits to process such data only in a 26 deidentified fashion and not attempt to reidentify such data; and (c) 27 contractually obligates any recipients of such data to satisfy the 28 criteria set forth in (a) and (b) of this subsection. 29 (10) "Gender-affirming care information" means personal 30 information relating to seeking or obtaining past, present, or future 31 gender-affirming care services. "Gender-affirming care information" 32 includes, but is not limited to: 33 (a) Location information that could reasonably indicate a 34 consumer's attempt to acquire or receive gender-affirming care 35 services; 36 (b) Efforts to research or obtain gender-affirming care services; 37 or 38 p. 4 SB 5351 (c) Any gender-affirming care information that is derived, 1 extrapolated, or inferred, including from nonhealth information, such 2 as proxy, derivative, inferred, emergent, or algorithmic data. 3 (11) "Gender-affirming care services" means health services or 4 products that support and affirm an individual's gender identity 5 including, but not limited to, social, psychological, behavioral, 6 cosmetic, medical, or surgical interventions. "Gender-affirming care 7 services" includes, but is not limited to, treatments for gender 8 dysphoria, gender-affirming hormone therapy, and gender-affirming 9 surgical procedures. 10 (12) "Genetic data" means any data, regardless of its format, 11 that concerns a consumer's genetic characteristics. "Genetic data" 12 includes, but is not limited to: 13 (a) Raw sequence data that result from the sequencing of a 14 consumer's complete extracted deoxyribonucleic acid (DNA) or a 15 portion of the extracted DNA; 16 (b) Genotypic and phenotypic information that results from 17 analyzing the raw sequence data; and 18 (c) Self-reported health data that a consumer submits to a 19 regulated entity and that is analyzed in connection with consumer's 20 raw sequence data. 21 (13) "Geofence" means technology that uses global positioning 22 coordinates, cell tower connectivity, cellular data, radio frequency 23 identification, Wifi data, and/or any other form of location 24 detection to establish a virtual boundary around a specific physical 25 location. 26 (14) "Health care services" means any service provided to a 27 person to assess, measure, improve, or learn about a person's health, 28 including but not limited to: 29 (a) Individual health conditions, status, diseases, or diagnoses; 30 (b) Social, psychological, behavioral, and medical interventions; 31 (c) Health-related surgeries or procedures; 32 (d) Use or purchase of medication; 33 (e) Bodily functions, vital signs, symptoms, or measurements of 34 the information described in this subsection; 35 (f) Diagnoses or diagnostic testing, treatment, or medication; 36 (g) Reproductive health care services; or 37 (h) Gender-affirming care services. 38 (15) "Homepage" means the introductory page of an internet 39 website and any internet webpage where personal information is 40 p. 5 SB 5351 collected. In the case of an online service, such as a mobile 1 application, homepage means the application's platform page or 2 download page, and a link within the application, such as from the 3 application configuration, "about," "information," or settings page. 4 (16) "Person" shall include, where applicable, natural persons, 5 corporations, trusts, unincorporated associations, and partnerships. 6 (17)(a) "Personal information" means information that identifies, 7 relates to, describes, or is reasonably capable of being associated 8 or linked, directly or indirectly, with a particular consumer. 9 "Personal information" includes, but is not limited to, data 10 associated with a persistent unique identifier, such as a cookie ID, 11 an IP address, a device identifier, or any other form of persistent 12 unique identifier. 13 (b) "Personal information" does not include publicly available 14 information. For purposes of this subsection, "publicly available" 15 means information that is lawfully made available from federal, 16 state, or local government records. Any biometric data collected 17 about a consumer by a business without the consumer's knowledge is 18 not publicly available information. 19 (c) "Personal information" does not include deidentified data. 20 (18) "Process" or "processing" means any operation or set of 21 operations performed on consumer health data. 22 (19) "Regulated entity" means any legal entity that (a) conducts 23 business in Washington, or produces or provides products or services 24 that are targeted to consumers in Washington; (b) collects, shares, 25 or sells consumer health data; and (c) determines the purpose and 26 means of the processing of consumer health data. "Regulated entity" 27 does not mean government agencies or tribal nations. 28 (20) "Reproductive or sexual health information" means personal 29 information relating to seeking or obtaining past, present, or future 30 reproductive or sexual health services. "Reproductive or sexual 31 health information" includes, but is not limited to: 32 (a) Location information that could reasonably indicate a 33 consumer's attempt to acquire or receive reproductive or sexual 34 health services; 35 (b) Efforts to research or obtain reproductive or sexual health 36 services; or 37 (c) Any reproductive or sexual health information that is 38 derived, extrapolated, or inferred, including from nonhealth 39 p. 6 SB 5351 information (such as proxy, derivative, inferred, emergent, or 1 algorithmic data). 2 (21) "Reproductive or sexual health services" means health 3 services or products that support or relate to an individual's 4 reproductive system or sexual well-being, including but not limited 5 to: 6 (a) Individual health conditions, status, diseases, or diagnoses; 7 (b) Social, psychological, behavioral, and medical interventions; 8 (c) Health-related surgeries or procedures including, but not 9 limited to, abortions; 10 (d) Use or purchase of medication including, but not limited to, 11 medications for the purposes of abortion; 12 (e) Bodily functions, vital signs, symptoms, or measurements of 13 the information described in this subsection; 14 (f) Diagnoses or diagnostic testing, treatment, or medication; 15 and 16 (g) Medical or nonmedical services related to and provided in 17 conjunction with an abortion, including but not limited to associated 18 diagnostics, counseling, supplies, and follow-up services. 19 (22)(a) "Sell" or "sale" means the sharing of consumer health 20 data for monetary or other valuable consideration. 21 (b) "Sell" or "sale" does not include the sharing of consumer 22 health data for monetary or other valuable consideration: 23 (i) To a third party as an asset that is part of a merger, 24 acquisition, bankruptcy, or other transaction in which the third 25 party assumes control of all or part of the regulated entity's assets 26 that shall comply with the requirements and obligations in this 27 chapter; 28 (ii) By a natural person selling their own consumer health data 29 pursuant to a written contract of sale with a third party; or 30 (iii) By a regulated entity to a service provider when such 31 sharing is consistent with the purpose for which the consumer health 32 data was collected and disclosed to the consumer. 33 (23) "Service provider" means a person that processes consumer 34 health data on behalf of a regulated entity. 35 (24)(a) "Share" or "sharing" means to release, disclose, 36 disseminate, divulge, make available, provide access to, license, or 37 otherwise communicate orally, in writing, or by electronic or other 38 means, consumer health data by a regulated entity to a third party or 39 affiliate. 40 p. 7 SB 5351 (b) The term "share" or "sharing" does not include: 1 (i) The disclosure of consumer health data by a regulated entity 2 to a service provider when such sharing is consistent with the 3 purpose for which the consumer health data was collected and 4 disclosed to the consumer; 5 (ii) The disclosure of consumer health data to a third party with 6 whom the consumer has a direct relationship when: (A) The disclosure 7 is for purposes of providing a product or service requested by the 8 consumer; (B) the regulated entity maintains control and ownership of 9 the data; and (C) the third party uses the consumer health data only 10 at direction from the regulated entity and consistent with the 11 purpose for which it was collected and disclosed to the consumer; or 12 (iii) The disclosure or transfer of personal data to a third 13 party as an asset that is part of a merger, acquisition, bankruptcy, 14 or other transaction in which the third party assumes control of all 15 or part of the regulated entity's assets and shall comply with the 16 requirements and obligations in this chapter. 17 (25) "Third party" means an entity other than a consumer, 18 regulated entity, service provider, or affiliate of the regulated 19 entity. 20 NEW SECTION. Sec. 4. (1) A regulated entity shall maintain a 21 consumer health data privacy policy that clearly and conspicuously 22 discloses: 23 (a) The specific types of consumer health data collected and the 24 purpose for which the data is collected, including the specific ways 25 in which it will be used; 26 (b) The sources from which the consumer health data is collected; 27 (c) The specific consumer health data that is shared; 28 (d) A list of third parties and affiliates with whom the 29 regulated entity shares the consumer health data, including an active 30 email address or other online mechanism that the consumer may use to 31 contact these third parties and affiliates; and 32 (e) How a consumer can exercise the rights provided in section 6 33 of this act. 34 (2) A regulated entity shall prominently publish its consumer 35 health data privacy policy on its homepage. 36 (3) A regulated entity may not collect, use, or share additional 37 categories of consumer health data not disclosed in the consumer 38 health data privacy policy without first disclosing the additional 39 p. 8 SB 5351 categories and obtaining the consumer's affirmative consent prior to 1 the collection, use, or sharing of such consumer health data. 2 (4) A regulated entity may not collect, use, or share consumer 3 health data for additional purposes not disclosed in the consumer 4 health data privacy policy without first disclosing the additional 5 purposes and obtaining the consumer's affirmative consent prior to 6 the collection, use, or sharing of such consumer health data. 7 (5) It is a violation of this chapter for a regulated entity to 8 contract with a service provider to process consumer health data in a 9 manner that is inconsistent with the regulated entity's consumer 10 health data privacy policy. 11 NEW SECTION. Sec. 5. (1) A regulated entity may not collect any 12 consumer health data except: 13 (a) With consent from the consumer for such collection for a 14 specified purpose; or 15 (b) To the extent strictly necessary to provide a product or 16 service that the consumer to whom such consumer health data relates 17 has requested from such regulated entity. 18 (2) A regulated entity may not share any consumer health data 19 except: 20 (a) With consent from the consumer for such sharing that is 21 separate and distinct from the consent obtained to collect consumer 22 health data; or 23 (b) To the extent strictly necessary to provide a product or 24 service that the consumer to whom such consumer health data relates 25 has requested from such regulated entity. 26 (3) Consent required under this section must be obtained prior to 27 the collection or sharing, as applicable, of any consumer health 28 data, and the request for consent must clearly and conspicuously 29 disclose: (a) The categories of consumer health data collected or 30 shared; (b) the purpose of the collection or sharing of the consumer 31 health data, including the specific ways in which it will be used; 32 (c) the entities with whom the consumer health data is shared; and 33 (d) how the consumer can withdraw consent from future collection or 34 sharing of the consumer's health data. 35 (4) A regulated entity may not discriminate against a consumer 36 for exercising any rights included in this chapter. 37 p. 9 SB 5351 NEW SECTION. Sec. 6. (1) A consumer has the right to confirm 1 whether a regulated entity is collecting or sharing consumer health 2 data concerning the consumer and to access such data. 3 (2) A consumer has the right to confirm that a regulated entity 4 has not sold consumer health data concerning the consumer. 5 (3) A consumer has the right to withdraw consent from the 6 regulated entity's collection and sharing of consumer health data 7 concerning the consumer. 8 (4) A consumer has the right to have consumer health data 9 concerning the consumer deleted and may exercise that right by 10 informing the regulated entity of the consumer's request for 11 deletion. 12 (a) A regulated entity that receives a consumer's request to 13 delete any consumer health data concerning the consumer shall without 14 unreasonable delay and no more than 30 calendar days from receiving 15 the deletion request: 16 (i) Delete the consumer health data from its records, including 17 from all parts of the regulated entity's network or backup systems; 18 and 19 (ii) Notify all affiliates, service providers, contractors, and 20 other third parties with whom the regulated entity has shared 21 consumer health data of the deletion request. 22 (b) All affiliates, service providers, contractors, and other 23 third parties that receive notice of a consumer's deletion request 24 shall honor the consumer's deletion request and delete the consumer 25 health data from its records, including from all parts of its network 26 or backup systems. 27 (5) A consumer may exercise the rights set forth in this chapter 28 by submitting a request, at any time, to a regulated entity. Such a 29 request may be made by contacting the regulated entity through the 30 manner included in its consumer health data privacy policy. 31 NEW SECTION. Sec. 7. (1) A regulated entity shall restrict 32 access to consumer health data by the employees, service providers, 33 and contractors of such regulated entity to only those employees, 34 service providers, and contractors for which access is necessary to 35 further the purposes for which the consumer provided consent or where 36 strictly necessary to provide a product or service that the consumer 37 to whom such data and information relates has requested from such 38 regulated entity. 39 p. 10 SB 5351 (2) A regulated entity shall establish, implement, and maintain 1 administrative, technical, and physical data security practices that, 2 at a minimum, satisfy reasonable standard of care within the 3 regulated entity's industry to protect the confidentiality, 4 integrity, and accessibility of consumer health data appropriate to 5 the volume and nature of the personal data at issue. 6 NEW SECTION. Sec. 8. (1)(a) A service provider may process 7 consumer health data only pursuant to a binding contract between the 8 service provider and the regulated entity that sets forth the 9 processing instructions and limit the actions the service provider 10 may take with respect to the consumer health data it processes on 11 behalf of the regulated entity. 12 (b) A service provider may process consumer health data only in a 13 manner that is consistent with the binding instructions set forth in 14 the contract with the regulated entity. 15 (2) A service provider shall assist the regulated entity by 16 appropriate technical and organizational measures, insofar as this is 17 possible, in fulfilling the regulated entity's obligations under this 18 chapter. 19 (3) If a service provider fails to adhere to the regulated 20 entity's instructions or processes consumer health data in a manner 21 that is outside the scope of the service provider's contract with the 22 regulated entity, the service provider is considered a regulated 23 entity and is subject to all the requirements of this chapter. 24 NEW SECTION. Sec. 9. It is unlawful for any person including, 25 but not limited to, regulated entities or service providers, to sell 26 consumer health data. 27 NEW SECTION. Sec. 10. It is unlawful for any person to 28 implement a geofence around any entity that provides in-person health 29 care services where such geofence is used to identify, track, collect 30 data from, or send notifications or messages to a consumer that 31 enters the virtual perimeter. 32 NEW SECTION. Sec. 11. The legislature finds that the practices 33 covered by this chapter are matters vitally affecting the public 34 interest for the purpose of applying the consumer protection act, 35 chapter 19.86 RCW. A violation of this chapter is not reasonable in 36 p. 11 SB 5351 relation to the development and preservation of business, and is an 1 unfair or deceptive act in trade or commerce and an unfair method of 2 competition for the purpose of applying the consumer protection act, 3 chapter 19.86 RCW. 4 NEW SECTION. Sec. 12. (1) This chapter does not apply to: 5 (a) Protected health information, or information treated like 6 protected health information, collected, used, or disclosed by 7 covered entities and business associates when: (i) The protected 8 health information is collected, used, or disclosed in accordance 9 with the federal health insurance portability and accountability act 10 of 1996 and the health information technology for economic and 11 clinical health act, 45 C.F.R. Parts 160 and 164, and its 12 implementing regulations; and (ii) the protected health information 13 is afforded all the privacy protections and security safeguards of 14 those federal laws and their implementing regulations. For the 15 purpose of this subsection (1), "protected health information," 16 "covered entity," and "business associate" have the same meaning as 17 in the federal health insurance portability and accountability act of 18 1996 and its implementing regulations; 19 (b) Patient identifying information collected, used, or disclosed 20 in accordance with 42 C.F.R. Part 2, established pursuant to 42 21 U.S.C. Sec. 290dd-2; or 22 (c) Health care information collected, used, or disclosed in 23 accordance with chapter 70.02 RCW. 24 (2) Nothing in this chapter shall be construed to prohibit 25 disclosure as required under chapters 26.44 and 74.34 RCW. 26 NEW SECTION. Sec. 13. If any provision of this act or its 27 application to any person or circumstance is held invalid, the 28 remainder of the act or the application of the provision to other 29 persons or circumstances is not affected. 30 NEW SECTION. Sec. 14. Sections 1 through 12 of this act 31 constitute a new chapter in Title 19 RCW. 32 --- END --- p. 12 SB 5351