Summer 2023 gave us a blast of new and distinctive consumer health data privacy legislation. The Washington legislature could not wait to start showing off and splashing around in the summer sun by passing the country’s first-of-its-kind consumer health data privacy law. You can dive into important insights and practical tips for complying with the Washington My Health My Data Act (“WMHMDA”) in our WMHMDA Summer Series.

In June, Nevada and Connecticut opted to keep the summer fling going. The Nevada legislature enacted Nevada’s Consumer Health Privacy Law (“NCHPL”) which models restrictions from WMHMDA with some important modifications, and the Connecticut legislature amended the Connecticut Data Privacy Act (“CTDPA”) to incorporate health data processing limitations.

As the summer days continue drifting away, we will tell you more about how to prevent your summer dreams from being ripped at the seams by new compliance obligations. (Read that in your best Danny Zuko voice.)

Nevada. On June 16, 2023, the Nevada legislature took a turn in the Greased Lightning when it enacted a consumer privacy law specific to health data that mimics many requirements established by WMHMDA. Compliance with NCHPL becomes mandatory on March 31, 2024 (the same day as WMHMDA). However, NCHPL does not contain the same deadline extension afforded to entities qualifying as a “Small Business” under WMHMDA (which receive a short extension on compliance with certain WMHMDA provisions).

Connecticut. In May 2022, the Connecticut legislature passed the CTDPA, with an effective date of July 1, 2023. On June 26, 2023, Connecticut’s Governor signed an amendment (SB 3) to CTDPA designed to place previously omitted limitations on the processing and sale of consumer health data and to promote children’s online safety. Notably the relevant consumer health data amendments, like the CTDPA, also became effective on July 1, 2023. This left only five days between the time the amendment was signed into law and its effective date. Nobody panic – you don’t need to drop out and go to beauty school.

Comparison. If you collect, use, store, or disclose consumer health data, there is nothing else left for us to do except help you assess how these new laws may affect your business. For example, all three laws require organizations to develop a consumer health data privacy policy and deploy data processing agreements. In addition, as you build your compliance program, we recommend hopelessly devoting your attention to the following notable requirements:

Note: Links in the chart need to be accessed here: WMHMDA Summer Series.