Photo of Ashton Harris

Ashton provides regulatory counsel to healthcare providers and industry partners, helping them navigate complex and frequently-changing rules.

Keypoint: The New York legislature passes broad and restrictive health data privacy legislation with implications for businesses both within and outside New York.

Last week, the New York legislature passed the New York Health Information Privacy Act (S 929) (the “Act”). If signed into law, the Act will add New York to the list of states that have enacted consumer health data-specific privacy legislation in response to the U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization.

Although the Act is not a clone of Washington’s My Health My Data Act (“MHMD”), it follows many of the same themes: regulating health data beyond the state’s borders, utilizing a broad definition of health data, and imposing additional obligations and narrower exemptions than those seen in generally applicable consumer privacy legislation.

Below, we provide a summary of the Act and identify some of the unique challenges it poses for affected companies.

Keypoint: In the aftermath of the Supreme Court’s Dobbs decision, Washington legislators introduced legislation to enhance privacy protections for consumer health data.

In early March, lawmakers in Washington state’s House passed an amended version of the My Health My Data Act (HB 1155). The Act seeks to implement sweeping changes to how companies treat the consumer health data of Washington residents. The Act is supported by the Attorney General’s office and was filed in response to the United States Supreme Court’s Dobbs decision overturning Roe v. Wade. The Act is currently scheduled for a March 14 public hearing in the Senate Committee on Law & Justice.

In the below post, we provide a brief summary of the Act as it passed the House on March 4. The Act underwent significant amendments prior to passing the House and could undergo further amendments in the Senate. Consequently, this post is intended only to provide a point-in-time analysis.