Washington’s My Health My Data Act covers consumer health data that falls outside HIPAA. For many companies, that includes data their vendors process every day.
Three clauses to check
Consent. Does the vendor need separate consent before it collects or shares consumer health data?
Use limits. Is the vendor limited to the purposes in your agreement, with no sale of the data?
Deletion. Can you require the vendor to delete the data, and how quickly?
Proviso’s policy checks now include the Act, so each vendor agreement is checked against these requirements before signature.
