Businesses that fail to comply with the My Health, My Data Act may face consumer litigation and enforcement action by the Washington State Attorney General.
Any violation of the Act is characterized as:
- An unfair or deceptive act;
- Occurring in trade or commerce; and
- Is a matter that vitally affects the public interest.
This language mirrors three of the five criteria[1] to prove a violation of the Washington State Consumer Protection Act (CPA).
Therefore, the Washington State Attorney General will likely take an active role in investigating any suspected violations of the Act and initiating enforcement proceedings to penalize businesses. Violations could include, for example, selling consumer health data without appropriate authorization, or failing to comply with a consumer’s request to delete health data. The monetary penalty for each violation of the CPA is $7,500 with the possibility of a $5,000 enhanced penalty if the violation targets or impacts individuals or communities based on demographic characteristics.
The CPA also includes a private right of action that permits consumers to sue businesses for unfair or deceptive practices. In such lawsuits, consumers may seek remedies such as recovery of actual damages sustained by the consumer, treble (i.e., triple) damages up to $25,000 per violation, injunctive relief, and reimbursement of the costs of the lawsuit, including attorney fees. Consumers can also file class action lawsuits against businesses under the CPA. Damages can add up significantly in a class action lawsuit as they may be calculated on a per-person basis for each affected consumer.
To mitigate the risk of legal action by consumers or the state, businesses that are subject to the My Health, My Data Act should develop a plan for compliance with the Act. Please contact Casey Moriarty or Maddie Haller of the Ogden Murphy Wallace health care team for more information.
[1] The other two criteria are: (a) injury to the plaintiff in his or her business or property; and (b) causation between the unfair or deceptive practice and the injury suffered.
