OLYMPIA — Attorney General Bob Ferguson announced Friday that he is partnering with Rep. Vandana Slatter, D-Bellevue and Sen. Manka Dhingra, D-Redmond, to propose legislation in the 2023 legislative session to increase data privacy protections in the wake of the Dobbs Supreme Court decision empower Washingtonians with more control over their health data.
Under current law, Washingtonians’ health data is left vulnerable to being used by advertisers or shared with anti-choice groups. For example:
- Period tracking apps can sell sensitive information about a woman’s late period or miscarriage to data brokers. Data brokers can link that information to her data profile, which is essentially for sale on the open market. Law enforcement from states with strict anti-abortion laws or anti-choice advocacy groups can purchase that data profile and use that information to prosecute women who had an abortion or miscarriage in another state.
- Pregnant individuals sometimes contact or visit crisis pregnancy centers looking for reproductive health care services, only to find that they cannot receive an abortion at that facility. But while they are there, the crisis pregnancy center can collect and share the woman’s sensitive data with anti-abortion groups who can then target the woman with pro-life messaging and political ads.
- Digital advertising firms can set up geofencing around health care facilities that trip when a person brings their cell phone or mobile device across the barrier. The individual can be bombarded with text messages and advertisements urging them not to seek reproductive or gender-affirming care.
This legislation from Dhingra, Slatter, and Ferguson:
- Prohibits organizations from selling Washingtonians’ health data.
- Blocks apps and websites — like health tracking apps, search engines, and advertisers — from collecting and sharing Washingtonians’ health data without their consent.
- Prohibits “geofences” from being used at reproductive and gender affirming health care facilities. Geofences are a virtual perimeter around a physical location that can be used to send messages to a person who enters a specific location.
- Requiring companies that collect Washingtonians’ personal health data to maintain and publish a privacy policy for consumers’ health data
The bill may be known as the EMPOWHERD Act (Enforcing Measures Protecting Our Washington Health Electronic Rights and Data). Violations of the Act are a violation of the Consumer Protection Act.
“This law will give Washingtonians more control over how their health data is used,” Ferguson said. “This is a key part of protecting Washingtonians’ access to safe, private reproductive care — which is more urgent now than ever.”
“I believe this bill is an important opportunity to protect our health data — particularly during an unprecedented time in which our constitutional rights to reproductive health and bodily autonomy are being attacked across the country,” Rep. Slatter said. “As a clinical pharmacist, I had the honor of testifying on the importance of Plan B and comprehensive reproductive care. As a legislator, I am honored to sponsor this bill in the House to protect health data and privacy in Washington state.”
“It is unconscionable that people’s personal data regarding accessing reproductive health care is being used for criminal prosecution,” Sen. Dhingra said. “With ideological attacks on reproductive and gender-affirming care nationwide, it is critical that Washington state establishes best practices and a national model for protecting the right to privacy we all deserve and need. I look forward to working with Attorney General Ferguson, Governor Inslee, the tech industry, advocates, and my colleagues to continue developing policies that safeguard access to care, provide safe haven for individuals seeking care in our state, and ensure that health-related data is protected from government interference and intimidation.”
“I want to thank Sen. Dhingra, Rep. Slatter, and Attorney General Ferguson for leading the effort to strengthen protections for patient and provider data,” Gov. Jay Inslee said. “It is inexcusable that private, protected health care patient and provider data would be shared for purposes outside of needed care. We’re not going to allow it in Washington.”
Washingtonians expect that their health data is protected under laws like the Health Information Portability and Accountability Act (HIPAA). However, HIPAA only covers health data collected by specific health care entities, including most health care providers. Health data collected by other entities — including apps and websites — are not afforded the same protections.
This bill closes the gap in health data privacy protections.