Washington state bill would make period-tracking apps follow privacy laws in reflection of post-Roe fears

By Shawna Mizelle, CNN

A bill introduced by Democrats in Washington’s state legislature would prevent private health data that is collected by apps — particularly those that track menstrual cycles — from being shared without consumers’ consent.

The proposed law, called the My Health, My Data Act, reflects fears by some women that, following last year’s Supreme Court decision that ended the federal constitutional right to an abortion, period-tracking data could be used by authorities to charge them with crimes if they run afoul of abortion laws.

Patients’ medical information is typically protected by the Health Insurance Portability and Accountability Act, known as HIPAA, but the same protections do not apply to health data shared with third-party apps and websites.

“Over the last year, we have seen continued, unprecedented attacks across our nation on the right to reproductive health care and bodily autonomy. Numerous vulnerabilities in people’s health data privacy have been highlighted and exacerbated as a result, putting individuals in harm’s way by data brokers and predatory data tracking companies. The My Health, My Data Act will address the collection, sharing, and selling of sensitive health-related data,” Democratic Rep. Vandana Slatte, who introduced the House bill, told CNN in a statement.

The proposed law, which was brought forth in both Democratic-controlled chambers, would prohibit the selling of consumer health data and require “additional disclosures and consumer consent regarding the collection, sharing, and use of such information.”

It would also allow users to delete their data and would prohibit the use of “geofence” technology around facilities that provide health care services if it uses information such as cell tower data and wifi to collect data about consumers’ identities and movements.

The proposal also covers health data related to such issues as gender-affirming care and genetics.

The law would cover Washington residents or those whose consumer health data is collected in the state and would be enforced under the state’s consumer protection law. It would apply to businesses that provide “products or services that are targeted to consumers in Washington.”

Pregnancy Justice, a nonprofit that provides legal representation for people charged with crimes related to pregnancy, said they have not tracked any specific instances of data from period-tracking apps being used against women.

But, the organization told CNN, “that’s not to say that the apps aren’t a reason for concern.”

One example that is often cited by abortion-rights proponents in the post-Roe legal landscape is a case that began even before Roe was overturned. A Nebraska mother and her 18-year-old daughter were charged last year after police obtained Facebook messages between the two. Authorities allege the messages show evidence of an illegal self-managed medication abortion, as well as a plan to hide the remains. They both pleaded not guilty.

“With the significant growth in the use of tracking apps, online chats, social media and search engines for accessing health care information, advice and research, these protections for sensitive health data are long overdue,” said Sen. Manka Dhingra, one of the sponsors of the state Senate’s companion bill, SB 5351. “And with the US Supreme Court’s decision to overturn 50 years of precedent and put reproductive freedom in danger, it’s all the more urgent that we take action.”

Similar legislation was signed into law last year in California by Democratic Gov. Gavin Newsom. It bars companies based in the state from giving up geolocation data, search histories and other personal information in response to out-of-state search warrants, unless those warrants are accompanied by a statement that the evidence sought isn’t connected to an abortion investigation.

The-CNN-Wire
™ & © 2023 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.