HB 1155 — Addressing the collection, sharing, and selling of consumer health data.

p.(e) Bodily functions, vital signs, symptoms, or measurements of the information described in this subsection;

5 ESHB 1155 (e) Bodily functions, vital signs, symptoms, or measurements of the information described in this subsection;

(16)(15) "Homepage" means the introductory page of an internet website and any internet webpage where personal information is collected.p.

5 HB 1155 collected.

(17)(16) "Person" means,shall include, where applicable, natural persons, corporations, trusts, unincorporated associations, and partnerships.

"Person"(17)(a) does"Personal notinformation" includemeans governmentinformation agencies,that tribalidentifies, nations,relates to, describes, or contractedis servicereasonably providerscapable whenof processingbeing consumerassociated healthor datalinked, ondirectly behalfor ofindirectly, with a governmentparticular agency.consumer.

(18)(a) "Personal information" means information that identifies or is reasonably capable of being associated or linked, directly or indirectly, with a particular consumer.

For purposes of this subsection, "publicly available" means information that is lawfully made available from federal, state, or local government records.

(19)(18) "Precise"Process" locationor information""processing" means informationany derivedoperation from technology including, but not limited to, global positioning system level latitude and longitude coordinates or otherset mechanisms, that directly identifies the specific location of anoperations individualperformed withon precisionconsumer andhealth accuracydata. within a radius of 1,750 feet.

"Precise(19) location"Regulated information"entity" doesmeans notany includelegal theentity contentthat of(a) communications,conducts orbusiness anyin dataWashington, generatedor byproduces or connectedprovides toproducts advancedor utilityservices meteringthat infrastructureare systemstargeted orto equipmentconsumers forin useWashington; by a utility.

(20)(b) "Process"collects, orshares, "processing" means any operation or setsells of operations performed on consumer health data.data;

(21)and "Processor"(c) meansdetermines athe personpurpose thatand processesmeans consumerof healththe dataprocessing on behalf of aconsumer regulatedhealth entity.data.

p."Regulated entity" does not mean government agencies or tribal nations.

6(20) ESHB"Reproductive 1155or (22)sexual "Publiclyhealth available information" means personal information thatrelating (a)to isseeking lawfullyor madeobtaining availablepast, throughpresent, federal, state, or municipalfuture governmentreproductive records or widelysexual distributedhealth media,services. and (b) a regulated entity has a reasonable basis to believe a consumer has lawfully made available to the general public.

(23) "Regulated entity" means any legal entity that:

(a) Conducts business in Washington, or produces or provides products or services that are targeted to consumers in Washington;

and (b) alone or jointly with others, determines the purpose and means of collecting, processing, sharing, or selling of consumer health data.

"Regulated entity" does not mean government agencies, tribal nations, or contracted service providers when processing consumer health data on behalf of the government agency.

(24) "Reproductive or sexual health information" means personal information relating to seeking or obtaining past, present, or future reproductive or sexual health services.

(a) PreciseLocation location information that could reasonably indicate a consumer's attempt to acquire or receive reproductive or sexual health services;

or (c) Any reproductive or sexual health information that is derived, extrapolated, or inferred, including from nonhealth informationp. (such as proxy, derivative, inferred, emergent, or algorithmic data).

(25)6 "ReproductiveHB or1155 sexualinformation health(such services"as meansproxy, healthderivative, servicesinferred, oremergent, products that support or relatealgorithmic todata). a consumer's reproductive system or sexual well-being, including but not limited to:

(21) "Reproductive or sexual health services" means health services or products that support or relate to an individual's reproductive system or sexual well-being, including but not limited to:

and p.(g) Medical or nonmedical services related to and provided in conjunction with an abortion, including but not limited to associated diagnostics, counseling, supplies, and follow-up services.

7(22)(a) ESHB"Sell" 1155 (g) Medical or nonmedical"sale" servicesmeans relatedthe tosharing andof providedconsumer inhealth conjunctiondata withfor anmonetary abortion,or includingother butvaluable notconsideration. limited to associated diagnostics, counseling, supplies, and follow-up services.

(26)(a)(b) "Sell" or "sale" meansdoes not include the exchangesharing of consumer health data for monetary or other valuable consideration.consideration:

(b)(i) "Sell"To a third party as an asset that is part of a merger, acquisition, bankruptcy, or "sale"other doestransaction notin includewhich the exchangethird party assumes control of consumerall healthor datapart forof monetarythe orregulated otherentity's valuableassets consideration:that shall comply with the requirements and obligations in this chapter;

(i)(ii) ToBy a thirdnatural partyperson asselling antheir assetown thatconsumer ishealth partdata ofpursuant to a merger,written acquisition,contract bankruptcy, or other transaction in which the third party assumes control of allsale or part of the regulated entity's assets that complies with thea requirementsthird andparty; obligations in this chapter;

or (ii)(iii) By a regulated entity to a processorservice provider when such exchangesharing is consistent with the purpose for which the consumer health data was collected and disclosed to the consumer.

(27)(a)(23) "Share""Service orprovider" "sharing" means toa release,person disclose,that disseminate,processes divulge, make available, provide access to, license, or otherwise communicate orally, in writing, or by electronic or other means, consumer health data byon abehalf regulatedof entity to a thirdregulated partyentity. or affiliate.

(b)(24)(a) The"Share" termor "share""sharing" means to release, disclose, disseminate, divulge, make available, provide access to, license, or "sharing"otherwise doescommunicate notorally, include:in writing, or by electronic or other means, consumer health data by a regulated entity to a third party or affiliate.

(i)p. The disclosure of consumer health data by a regulated entity to a processor when such sharing is to provide goods or services in a manner consistent with the purpose for which the consumer health data was collected and disclosed to the consumer;

7 HB 1155 (b) The term "share" or "sharing" does not include:

(i) The disclosure of consumer health data by a regulated entity to a service provider when such sharing is consistent with the purpose for which the consumer health data was collected and disclosed to the consumer;

or (iii) The disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the regulated entity's assets and compliesshall comply with the requirements and obligations in this chapter.

(28)(25) "Third party" means an entity other than a consumer, regulated entity, processor,service provider, or affiliate of the regulated entity.

p.NEW SECTION.

8 ESHB 1155 NEW SECTION.

(a) The categoriesspecific types of consumer health data collected and the purpose for which the data is collected, including how the dataspecific ways in which it will be used;

(b) The categories of sources from which the consumer health data is collected;

(c) The categoriesspecific of consumer health data that is shared;

(d) A list of the categories of third parties and specific affiliates with whom the regulated entity shares the consumer health data;data, including an active email address or other online mechanism that the consumer may use to contact these third parties and affiliates;

(2) A regulated entity shall prominently publish a link to its consumer health data privacy policy on its homepage.

(3) A regulated entity may not collect, use, or share additional categories of consumer health data not disclosed in the consumer health data privacy policy without first disclosing the additional categoriesp. and obtaining the consumer's affirmative consent prior to the collection, use, or sharing of such consumer health data.

8 HB 1155 categories and obtaining the consumer's affirmative consent prior to the collection, use, or sharing of such consumer health data.

(5) It is a violation of this chapter for a regulated entity to contract with a processorservice provider to process consumer health data in a manner that is inconsistent with the regulated entity's consumer health data privacy policy.

or (b) To the extent strictly necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity.

p.(a) With consent from the consumer for such sharing that is separate and distinct from the consent obtained to collect consumer health data;

9or ESHB(b) 1155To (a)the Withextent consentstrictly fromnecessary theto consumerprovide fora suchproduct sharingor service that isthe separateconsumer andto distinctwhom fromsuch theconsumer consenthealth obtaineddata torelates collecthas consumerrequested healthfrom data;such regulated entity.

or (b) To the extent necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity.

(c) the categories of entities with whom the consumer health data is shared;

(4) A regulated entity may not unlawfully discriminate against a consumer for exercising any rights included in this chapter.

NEWp. SECTION.

9 HB 1155 NEW SECTION.

(1) A consumer has the right to confirm whether a regulated entity is collecting,collecting sharing, or sellingsharing consumer health data concerning the consumer and to access such data,data. including a list of all third parties and affiliates with whom the regulated entity has shared or sold the consumer health data and an active email address or other online mechanism that the consumer may use to contact these third parties.

(2) A consumer has the right to withdrawconfirm consentthat froma the regulated entity'sentity collectionhas andnot sharingsold of consumer health data concerning the consumer.

(3) A consumer has the right to havewithdraw consumerconsent healthfrom data concerning the consumerregulated deletedentity's collection and maysharing exerciseof thatconsumer righthealth bydata informingconcerning the regulatedconsumer. entity of the consumer's request for deletion.

(a)(4) A regulatedconsumer entityhas thatthe receivesright a consumer's request to deletehave any consumer health data concerning the consumer shalldeleted withoutand unreasonablemay delayexercise andthat noright moreby thaninforming 30the calendarregulated daysentity fromof authenticating the deletionconsumer's request:request for deletion.

(i)(a) DeleteA theregulated consumerentity healththat datareceives froma itsconsumer's records,request includingto fromdelete allany partsconsumer ofhealth data concerning the regulatedconsumer entity'sshall network,without includingunreasonable archiveddelay orand backupno systemsmore pursuantthan to30 (c)calendar ofdays thisfrom subsection;receiving the deletion request:

and(i) p.Delete the consumer health data from its records, including from all parts of the regulated entity's network or backup systems;

10and ESHB 1155 (ii) Notify all affiliates, processors,service providers, contractors, and other third parties with whom the regulated entity has shared consumer health data of the deletion request.

(b) All affiliates, processors,service providers, contractors, and other third parties that receive notice of a consumer's deletion request shall honor the consumer's deletion request and delete the consumer health data from its records, subjectincluding tofrom theall sameparts requirements of thisits chapter.network or backup systems.

(c)(5) IfA consumer health data that a consumer requests to be deleted is stored on archived or backup systems, then the request for deletion may beexercise delayed to enable restoration of the archivedrights orset backupforth systemsin andthis suchchapter delayby maysubmitting nota exceedrequest, sixat monthsany fromtime, authenticatingto thea deletionregulated request.entity.

(4)Such Aa consumerrequest may exercisebe themade rightsby setcontacting forththe inregulated thisentity chapterthrough bythe submittingmanner aincluded request,in atits anyconsumer time,health todata aprivacy regulatedpolicy. entity.

Such a request may be made by a secure and reliable means established by the regulated entity and described in its consumer health data privacy policy.

The method must take into account the ways in which consumers normally interact with the regulated entity, the need for secure and reliable communication of such requests, and the ability of the regulated entity to authenticate the identity of the consumer making the request.

A regulated entity may not require a consumer to create a new account in order to exercise consumer rights pursuant to this chapter but may require a consumer to use an existing account.

(5) If a regulated entity is unable to authenticate the request using commercially reasonable efforts, the regulated entity is not required to comply with a request to initiate an action under this section and may request that the consumer provide additional information reasonably necessary to authenticate the consumer and the consumer's request.

(6) Information provided in response to a consumer request must be provided by a regulated entity free of charge, up to twice annually per consumer.

If requests from a consumer are manifestly unfounded, excessive, or repetitive, the regulated entity may charge the consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request.

The regulated entity bears the burden of demonstrating the manifestly unfounded, excessive, or repetitive nature of the request.

(7) A regulated entity shall respond to the consumer without undue delay, but in all cases within 45 days of receipt of the p.

11 ESHB 1155 request submitted pursuant to the methods described in this section.

The response period may be extended once by 45 additional days when reasonably necessary, taking into account the complexity and number of the consumer's requests, so long as the regulated entity informs the consumer of any such extension within the initial 45-day response period, together with the reason for the extension.

(8) A regulated entity shall establish a process for a consumer to appeal the regulated entity's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decision.

The appeal process must be conspicuously available and similar to the process for submitting requests to initiate action pursuant to this section.

Within 45 days of receipt of an appeal, a regulated entity shall inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

If the appeal is denied, the regulated entity shall also provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the attorney general to submit a complaint.

(1) A regulated entity shall restrict access to consumer health data by the employees, processors,service providers, and contractors of such regulated entity to only those employees, processors,service providers, and contractors for which access is necessary to further the purposes for which the consumer provided consent or where strictly necessary to provide a product or service that the consumer to whom such consumerdata healthand datainformation relates has requested from such regulated entity.

(2)p. A regulated entity shall establish, implement, and maintain administrative, technical, and physical data security practices that, at a minimum, satisfy reasonable standard of care within the regulated entity's industry to protect the confidentiality, integrity, and accessibility of consumer health data appropriate to the volume and nature of the personal data at issue.

10 HB 1155 (2) A regulated entity shall establish, implement, and maintain administrative, technical, and physical data security practices that, at a minimum, satisfy reasonable standard of care within the regulated entity's industry to protect the confidentiality, integrity, and accessibility of consumer health data appropriate to the volume and nature of the personal data at issue.

(1)(a) A processorservice provider may process consumer health data only pursuant to a binding contract between the processorservice provider and the regulated entity that sets forth the processing instructions and limit the actions the processorservice provider may take with respect to the consumer health data it processes on behalf of the regulated entity.

p.(b) A service provider may process consumer health data only in a manner that is consistent with the binding instructions set forth in the contract with the regulated entity.

12(2) ESHB 1155 (b) A processorservice mayprovider processshall consumerassist healththe dataregulated onlyentity inby aappropriate mannertechnical thatand isorganizational consistentmeasures, withinsofar theas bindingthis instructionsis setpossible, forth in fulfilling the contractregulated withentity's theobligations regulatedunder entity.this chapter.

(2)(3) AIf processora shallservice assistprovider fails to adhere to the regulated entityentity's byinstructions appropriateor technicalprocesses andconsumer organizationalhealth measures,data insofarin asa thismanner that is possible,outside inthe fulfillingscope of the service provider's contract with the regulated entity'sentity, obligationsthe underservice provider is considered a regulated entity and is subject to all the requirements of this chapter.

(3) If a processor fails to adhere to the regulated entity's instructions or processes consumer health data in a manner that is outside the scope of the processor's contract with the regulated entity, the processor is considered a regulated entity with regard to such data and is subject to all the requirements of this chapter with regard to such data.

(1) It is unlawful for any person toincluding, sellbut ornot offerlimited toto, sellregulated consumerentities healthor dataservice concerningproviders, ato sell consumer withouthealth firstdata. obtaining valid authorization from the consumer.

The sale of consumer health data must be consistent with the valid authorization signed by the consumer.

(2) A valid authorization to sell consumer health data is a document consistent with this section and must be written in plain language.

The valid authorization to sell consumer health data must contain the following:

(a) The specific consumer health data concerning the consumer that the person intends to sell;

(b) The name and contact information of the person collecting and selling the consumer health data;

(c) The name and contact information of the person purchasing the consumer health data from the seller identified in (b) of this subsection;

(d) A description of the purpose for the sale, including how the consumer health data will be gathered and how it will be used by the purchaser identified in (c) of this subsection when sold;

(e) A statement that the provision of goods or services may not be conditioned on the consumer signing the valid authorization;

(f) A statement that the consumer has a right to revoke the valid authorization at any time and a description on how to submit a revocation of the valid authorization;

(g) A statement that the consumer health data sold pursuant to the valid authorization may be subject to redisclosure by the purchaser and may no longer be protected by this section;

p.

13 ESHB 1155 (h) An expiration date for the valid authorization that expires one year from when the consumer signs the valid authorization;

and (i) The signature of the consumer and date.

(3) An authorization is not valid if the document has any of the following defects:

(a) The expiration date has passed;

(b) The authorization does not contain all the information required under this section;

(c) The authorization has been revoked by the consumer;

(d) The authorization has been combined with other documents to create a compound authorization;

or (e) The provision of goods or services is conditioned on the consumer signing the authorization.

(4) A copy of the signed valid authorization must be provided to the consumer.

(5) The seller and purchaser of consumer health data must retain a copy of all valid authorizations for sale of consumer health data for six years from the date of its signature or the date when it was last in effect, whichever is later.

It is unlawful for any person to implement a geofence around anany entity that provides in-person health care services where such geofence is used to:to identify, track, collect data from, or send notifications or messages to a consumer that enters the virtual perimeter.

(1) Identify or track consumers seeking health care services;

(2) collect consumer health data from consumers;

or (3) send notifications, messages, or advertisements to consumers related to their consumer health data or health care services.

(1)The For actions brought by the attorney general to enforce this chapter, the legislature finds that the practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW.

A violation of this chapter is not reasonable in relationp. to the development and preservation of business, and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

(2)11 AnyHB consumer1155 injuredrelation byto athe violationdevelopment and preservation of thisbusiness, chapterand mayis bringan unfair or deceptive act in trade or commerce and an actionunfair undermethod chapterof 19.86competition RCW,for butthe mustpurpose establishof allapplying requiredthe p.consumer protection act, chapter 19.86 RCW.

14 ESHB 1155 elements of an action under chapter 19.86 RCW before relief may be granted.

(a) InformationProtected thathealth meetsinformation, theor definitioninformation of:treated like protected health information, collected, used, or disclosed by covered entities and business associates when:

(i) ProtectedThe protected health information foris purposescollected, ofused, or disclosed in accordance with the federal health insurance portability and accountability act of 1996 and relatedthe regulations;health information technology for economic and clinical health act, 45 C.F.R.

(ii)Parts Health160 careand information164, collected,and used,its orimplementing disclosedregulations; in accordance with chapter 70.02 RCW;

(iii)and Patient(ii) identifyingthe protected health information collected,is used,afforded orall disclosedthe inprivacy accordanceprotections withand 42security C.F.R.safeguards of those federal laws and their implementing regulations.

For the purpose of this subsection (1), "protected health information," "covered entity," and "business associate" have the same meaning as in the federal health insurance portability and accountability act of 1996 and its implementing regulations;

(b) Patient identifying information collected, used, or disclosed in accordance with 42 C.F.R.

(iv)or Identifiable(c) privateHealth care information forcollected, purposesused, ofor thedisclosed federalin policyaccordance forwith thechapter protection70.02 ofRCW. human subjects, 45 C.F.R.

Part(2) 46;Nothing in this chapter shall be construed to prohibit disclosure as required under chapters 26.44 and 74.34 RCW.

identifiableNEW privateSECTION. information that is otherwise information collected as part of human subjects research pursuant to the good clinical practice guidelines issued by the international council for harmonization;

the protection of human subjects under 21 C.F.R.

Parts 50 and 56;

or personal data used or shared in research conducted in accordance with one or more of the requirements set forth in this subsection;

(v) Information and documents created specifically for, and collected and maintained by:

(A) A quality improvement committee for purposes of RCW 43.70.510, 70.230.080, or 70.41.200;

(B) A peer review committee for purposes of RCW 4.24.250;

(C) A quality assurance committee for purposes of RCW 74.42.640 or 18.20.390;

or (D) A hospital, as defined in RCW 43.70.056, for reporting of health care-associated infections for purposes of RCW 43.70.056, a notification of an incident for purposes of RCW 70.56.040(5), or reports regarding adverse events for purposes of RCW 70.56.020(2)(b);

(vi) Information and documents created for purposes of the federal health care quality improvement act of 1986, and related regulations;

(vii) Patient safety work product for purposes of 42 C.F.R.

Part 3, established pursuant to 42 U.S.C.

299b-21 through 299b-26;

(viii) Information that is (A) deidentified in accordance with the requirements for deidentification set forth in 45 C.F.R.

Part p.

15 ESHB 1155 164, and (B) derived from any of the health care-related information listed in this subsection (1)(a)(viii);

(b) Information originating from, and intermingled to be indistinguishable with, information under (a) of this subsection that is maintained by:

(i) A covered entity or business associate as defined by the health insurance portability and accountability act of 1996 and related regulations;

(ii) A health care facility or health care provider as defined in RCW 70.02.010;

or (iii) A program or a qualified service organization as defined by 42 C.F.R.

Part 2, established pursuant to 42 U.S.C.

Sec.

290dd-2;

(c) Information used only for public health activities and purposes as described in 45 C.F.R.

Sec.

164.512;

or (d) Identifiable data collected, used, or disclosed in accordance with chapter 43.371 RCW.

(2) Personal information that is governed by and collected, used, or disclosed pursuant to the following regulations, parts, titles, or acts, is exempt from this chapter:

(a) The Gramm-Leach-Bliley act (15 U.S.C.

6801 et seq.) and implementing regulations;

(b) part C of Title XI of the social security act (42 U.S.C.

1320d et seq.);

(c) the fair credit reporting act (15 U.S.C.

1681 et seq.);

(d) the family educational rights and privacy act (20 U.S.C.

1232g;

Part 99 of Title 34, C.F.R.);

(e) the Washington health benefit exchange and applicable statutes and regulations, including 45 C.F.R.

Sec.

155.260 and chapter 43.71 RCW;

or (f) privacy rules adopted by the office of the insurance commissioner pursuant to chapter 48.02 or 48.43 RCW.

(3) The obligations imposed on regulated entities and processors under this chapter does not restrict a regulated entity's or processor's ability for collection, use, or disclosure of consumer health data to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity;

preserve the integrity or security of systems;

or investigate, report, or prosecute those responsible for any such action.

(4) If a regulated entity or processor processes consumer health data pursuant to subsection (3) of this section, such entity bears the burden of demonstrating that such processing qualifies for the exemption and complies with the requirements of this section.

p.

16 ESHB 1155 NEW SECTION.

Sec.

1712 ESHBHB 1155