AG Ferguson, Rep. Slatter bill creating health data privacy protections passes Legislature

Photo by Irwan @tweetbyirwan on Unsplash

On Monday, April 17, 2023 the Legislature passed a bill Attorney General Bob Ferguson partnered on with Rep. Vandana Slatter, D-Bellevue, to close the gap on health data privacy protections.

The bill will provide Washingtonians more control of their health data and protect those who come from out of state to access reproductive and gender-affirming care.

The vote follows a Northwest Progressive Institute poll that showed 76% of Washingtonians support stronger privacy protections for their health data. 

The language in the poll mirrored the wording in the bill, HB1155.

The House approved the bill with a 57-39 vote in March. The bill passed the Senate with a 27-21 vote on April 5, but with amendments. The House agreed to those amendments today. It will now head to Gov. Inslee for his signature.

Sen. Manka Dhingra, D-Redmond, sponsored the companion bill in the Senate.

The new law will:

• Require entities that collect Washingtonians’ personal health data to publish a distinct privacy policy to disclose how they use that health data;
• Prohibit entities from collecting and sharing Washingtonians’ health data without their consent;
• Protect Washingtonians’ sensitive health data from being sold to third parties without valid authorization;
• Guarantee Washingtonians the right to withdraw consent and request their data be deleted; and
• Restrict geo-fencing around health care facilities to send Washingtonians messages.

The bill creates two ways to enforce the law: either the Attorney General’s Office can investigate violations and pursue litigation, or Washingtonians can bring their own civil lawsuits, using a private right of action. This legislation is one of the only data privacy bills in the nation that includes a private right of action.

“This law provides Washingtonians control over their personal health data,” Ferguson said. “Washingtonians deserve the right to decide who shares and sells their health data, and the freedom to demand that corporations delete their sensitive health data — and will now have these protections.”

More information here