Photo of Ashton Harris

Ashton Harris

Ashton provides regulatory counsel to healthcare providers and industry partners, helping them navigate complex and frequently-changing rules.

Contact:Read more about Ashton Harris

Keypoint: A new Virginia law prohibits the collection, use, or sharing of reproductive or sexual health information without consent and provides Virginians with a private right of action for at least $500 per violation.

As we previously reported, on March 24, 2025, Virginia Governor Glenn Youngkin signed SB 754 into law, adding Virginia to the list of states that restrict the use or disclosure of certain health information. Importantly, this is not an amendment to Virginia’s well-known Consumer Data Protection Act (“VCDPA”). Rather, SB 754 amends Sections 59.1-198 and 59.1-200 of the Virginia Consumer Protection Act (“VCPA”), Virginia’s general consumer protection law.

In the article below, we provide an overview of the new law and identify some of its potential implications, including the law’s creation of a private right of action that includes statutory damages.

Keypoint: Almost one year after the law went into effect, the first My Health My Data class action lawsuit was filed in Washington.

On February 10, 2025, a class action lawsuit was filed against an online retailer under the Washington My Health My Data (MHMD) Act’s private right of action. The complaint also alleges violations of federal wiretapping and computerized communications laws. MHMD went into effect on March 31, 2024. Despite initial speculation that the law would lead to significant civil litigation, no lawsuits were filed under it until now.

In this post, we provide a brief summary of the complaint, including the factual allegations, causes of action, and damages sought.

Keypoint: The New York legislature passes broad and restrictive health data privacy legislation with implications for businesses both within and outside New York.

Last week, the New York legislature passed the New York Health Information Privacy Act (S 929) (the “Act”). If signed into law, the Act will add New York to the list of states that have enacted consumer health data-specific privacy legislation in response to the U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization.

Although the Act is not a clone of Washington’s My Health My Data Act (“MHMD”), it follows many of the same themes: regulating health data beyond the state’s borders, utilizing a broad definition of health data, and imposing additional obligations and narrower exemptions than those seen in generally applicable consumer privacy legislation.

Below, we provide a summary of the Act and identify some of the unique challenges it poses for affected companies.

Keypoint: In the aftermath of the Supreme Court’s Dobbs decision, Washington legislators introduced legislation to enhance privacy protections for consumer health data.

In early March, lawmakers in Washington state’s House passed an amended version of the My Health My Data Act (HB 1155). The Act seeks to implement sweeping changes to how companies treat the consumer health data of Washington residents. The Act is supported by the Attorney General’s office and was filed in response to the United States Supreme Court’s Dobbs decision overturning Roe v. Wade. The Act is currently scheduled for a March 14 public hearing in the Senate Committee on Law & Justice.

In the below post, we provide a brief summary of the Act as it passed the House on March 4. The Act underwent significant amendments prior to passing the House and could undergo further amendments in the Senate. Consequently, this post is intended only to provide a point-in-time analysis.