My Health My Data

A group of students in the Technology Law and Public Policy Clinic spent the school year unraveling the complexities of consumer health data privacy, advocating for the privacy rights of Washingtonians.

When the U.S. Supreme Court ruling in Dobbs v. Jackson Women’s Organization (2022) upended the practice of abortion as a constitutionally protected right and gave legislative determination back to individual states, the decision also affected the protection of people’s personal health data at the state level.

On April 27, 2023, the Washington legislature passed the My Health My Data Act (MHMD) into law to protect Washington state residents and out-of-state consumers whose health data is being collected or processed in Washington. The new law addresses a gap in protection for consumer health data left unaddressed by existing privacy law. Spearheaded by Gov. Jay Inslee’s decisive action and subsequent legislation, this initiative underscores a pivotal moment in privacy rights advocacy.

A group of students in UW Law's Technology Law and Public Policy Clinic, directed by Teaching Professor William Covington, worked with Rep. Vandana Slatter of Washington’s 48th District to create a pamphlet communicating the tenets of the MHMD Act to members of the public. By disseminating informational brochures in community spaces such as UW’s Hall Health and the King County Public Library system, the students sought to ensure that every individual, irrespective of their background, could be informed of their rights which they can exercise under the new legislation.

The project aims to fortify consumer rights over personal health information in the digital age. The students delved deeply into the intricacies of the new law, dissecting its implications for both individuals and businesses alike.

Benjamin MacLean, J.D. ‘24, and rising 3L students Caroline Dolan, Jenna Lee, Anushka Parihar and Michelle Ullman met with Rep. Vandana Slatter, representatives from the Washington state Attorney General’s Office, and professionals from the UW Information School to delve into the implications of the law and learn how best to communicate these to the public.

Dolan, representing the student group, said, “At the core of our efforts is the goal to protect sensitive consumer data through transparency and consumer empowerment.” Indeed, the MHMD Act imposes stringent requirements on entities handling health-related information, transcending traditional boundaries set by federal laws like the Health Insurance Portability and Accountability Act (HIPAA).

“The clinical experience was not just about research. It was about making a tangible impact on people’s everyday lives,” said Covington. “The students’ work with MHMD is part of a broader movement towards a transparent and equitable digital future.”

In the students’ final presentation on May 15, the group elaborated on the MHMD Act’s provisions, highlighting its mandate for comprehensive privacy policies, explicit consumer consent mechanisms, and prohibitions on intrusive technologies such as geofencing in healthcare settings.

The team’s research extended beyond Washington’s borders, drawing parallels with California’s Consumer Privacy Act amended by the California Privacy Act, and global standards such as the European Union’s General Data Protection Regulation (GDPR). Dolan noted, “Aligning our regulations with those of the EU and other states’ practices signals that Washington state values privacy as a fundamental right and raises the bar for data protection nationwide.”

However, navigating the legal landscape has not been without its challenges. The group reflected on the ambiguities inherent in defining “consumer health data” and the broad scope of “regulated entities.” These ambiguities, Dolan warns, could potentially strain businesses striving to comply with the Act, leading to operational complexities and, in some cases, even market withdrawal from Washington. The private right of action raises additional concerns as it may burden the court system and result in excessive economic and administrative costs.

Yet, amidst these complexities, Dolan remains optimistic. “The MHMD Act signifies a paradigm shift towards individual data sovereignty,” she emphasizes. “It empowers consumers to reclaim control over their health-related information, fostering a culture of transparency and accountability.”

Looking ahead, the students anticipate further developments in healthcare data privacy laws nationwide. Covington says that Washington state is a “middle-stage adopter” in terms of policy changes. As momentum builds, states across the country are recognizing the urgency of safeguarding personal data.”

The MHMD project documents Washington’s conscientious approach to data privacy, ensuring that individuals’ rights are not just protected but respected in an increasingly interconnected world.