By Jennifer K. Wagner, J.D., Ph.D.<\/p>\n
<\/p>\n
While people tend to think of California as the state leading the nation on comprehensive data privacy law protections (with CCPA and CPRA<\/a>) and Illinois as the state leading the way on biometric-specific data protections<\/a> (with BIPA<\/a>), Washington is worthy of similar attention for its adoption of meaningful reproductive health privacy protections. On April 27, 2023, Washington Governor Jay Inslee signed<\/a> a suite of bills into law that strengthens reproductive health privacy protections. Because these laws have ramifications extending outside of the state, it is important for Pennsylvania attorneys to be familiar with them.<\/p>\n <\/p>\n As this blog has detailed previously<\/a>, the June 2022 U.S. Supreme Court decision in Dobbs v. Jackson Women\u2019s Health Organization<\/em><\/a> introduced extensive digital health privacy risks for everyone across the country. These risks are widely acknowledged to be particularly acute and intense for individuals who could become pregnant, individuals using a wide array of consumer health apps and wearables, and individuals from vulnerable communities or groups historically affected by healthcare and health disparities. The decision prompted the Department of Health and Human Services (DHHS) Office of Civil Rights (OCR) to quickly issue clarifying guidance<\/a> regarding the HIPAA Privacy Rule. On April 12, 2023, DHHS OCR announced<\/a> its issuance of a notice of proposed rulemaking<\/a> that would further strengthen reproductive health privacy protections available federal law by narrowing the law enforcement exception (45 CFR \u00a7164.512(f)<\/a>).<\/p>\n <\/p>\n The five new laws adopted in Washington just two weeks later boost privacy protections and reproductive health protections necessary for the Dobbs<\/em> era and specifically include (1) the \u201cMy Health, My Data\u201d Act, ESHB 1155<\/a>; (2) the \u201cShield Law,\u201d ESHB 1469<\/a>; (3) an act regarding medical licensing, ESHB 1340<\/a>; (4) an act regarding cost-sharing SB 5242<\/a>; and (5) an act regarding access to certain medications by mail, SB 5768<\/a>. Given the direct focus of the first two on data privacy (as opposed to decisional privacy), those are worth further discussion.<\/p>\n <\/p>\n The \u201cMy Health, My Data\u201d Act (or MHMDA) is impressive. It acknowledges the reality of the modern datafied culture in which we live: that is, that digital data of all sorts and perhaps in any setting could have health relevance and pose health privacy-related risks even if those data are not collected or used for health purposes by the company possessing those data. Some critics<\/a> consider this a mistaken approach, believe the definition of \u201cconsumer health data\u201d will be a compliance challenge, and warn of looming \u201cconsent fatigue.\u201d A thorough overview of the MHMDA<\/a> is available elsewhere, but here is a summary of its key aspects:<\/p>\n <\/p>\n The Shield Law (ESHB 1469<\/a>) was introduced as a companion to the My Health, My Data Act as a \u201crobust legal response<\/a>\u201d to other states that have used the Dobbs <\/em>decision to push forward forced birth laws with criminal and civil liability. Recognizing<\/a> that states (such as Texas, Oklahoma, and Idaho) have \u201cbounty\u201d laws incentivizing private citizens to sue licensed medical professionals providing certain reproductive health services and also that several states<\/a> (including Florida, Idaho, North Dakota, South Carolina, South Dakota, Tennessee, West Virginia, and Wyoming) have ushered in new forced birth laws that ban all or most abortions, legislators in Washington have sought to close the legal loopholes and gaps in health information privacy laws that would put individuals at substantial risk. Medical professionals (including genetic counselors and OB-GYN doctors) have been worried about the possibility that they could face criminal or civil court action simply for performing their jobs even in places where abortion and other reproductive health services are legal should that information become subject to law enforcement investigations. Some states have been trying to assuage those fears. For example, in 2022 Connecticut enacted a safe harbor law (HB 5414)<\/a> and Michigan Governor Gretchen Whitmer signed an executive order to protect medical providers in Michigan<\/a> from extradition orders. The shield law just passed in Washington takes aim at obligations regarding other states\u2019 criminal and civil process.<\/p>\n The shield law acknowledges the connection it has to the extradition\/rendition clause<\/a> found in Article IV, Section 2, Clause 2 of the U.S. Constitution. It is plausible that critics of the Washington shield law (as well as critics of other efforts to protect patients and providers from reproductive health services from criminal and civil liability in hostile states) will rely upon that constitutional provision as the basis for a legal challenge; however, it is apt to consider, as legal scholar Christopher Lasch has written<\/a> over a decade ago (in the context of Civil War era Northern resistance to extraditions involving slavery), \u201crendition resistance\u201d in the name of civil rights allows us to \u201cdifferentiate between fugitives from<\/em> justice and fugitives to<\/em> justice.\u201d<\/p>\n Washington is not alone in passing its shield law. For example, Colorado enacted SB 23-188<\/a> in April 2023<\/a> that includes some similar provisions. A bill in Pennsylvania, H.B. 924<\/a> introduced on April 17, 2023 as the \u201cWomen\u2019s Reproductive Health Care Compact Act,\u201d would address some similar issues; however, a robust effort to strengthen reproductive health privacy protections similar to what Washington has now achieved with the My Health, My Data Act and the Shield Act has not yet taken shape or gained momentum in Pennsylvania.<\/p>\n <\/p>\n <\/p>\n Jennifer K. Wagner, J.D., Ph.D., is a solo practicing attorney and also is Assistant Professor of Law, Policy, and Engineering at Penn State University. She has been a member of the PBA Cybersecurity & Data Privacy Committee since 2018, is a former contributing editor of the Genomics Law Report, and has published scholarly articles in prominent legal and scientific journals, including the Journal of Law & Biosciences; Journal of Law, Medicine, & Ethics; Albany Law Journal of Science & Technology; Virginia Sports and Entertainment Law Journal; North Carolina Journal of Law and Technology; Science; Nature Communications; Nature Medicine; American Journal of Human Genetics; Human Genetics and Genomics Advances; Genetics in Medicine; and PLOS Genetics. She served as a AAAS Congressional Fellow in a U.S. Senator\u2019s office in 2014-2015, and her work has been cited by the Supreme Court of the United States. You may follow her on Twitter as @DNAlawyer. Views expressed are her own.<\/p>\n","protected":false},"excerpt":{"rendered":" By Jennifer K. Wagner, J.D., Ph.D. While people tend to think of California as the state leading the nation on comprehensive data privacy law protections (with CCPA and CPRA) and Illinois as the state leading the way on biometric-specific data protections (with BIPA), Washington is worthy of similar attention for its adoption of meaningful \n
\n
Read More »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6,10],"tags":[],"_links":{"self":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/541"}],"collection":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/comments?post=541"}],"version-history":[{"count":3,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/541\/revisions"}],"predecessor-version":[{"id":544,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/541\/revisions\/544"}],"wp:attachment":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/media?parent=541"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/categories?post=541"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/tags?post=541"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}