State consumer health data laws

5 minutes 5 Questions

Washington's My Health My Data Act and comparable statutes covering health data outside HIPAA's reach.

Test mode:
Start practice test

CIPP/US - State consumer health data laws Example Questions

Test your knowledge of State consumer health data laws

Question 1

Which characteristic distinguishes Washington's My Health My Data Act from most comprehensive state consumer privacy statutes?

Correct Answer: It grants consumers a private right of action to sue for violations of the statute

Washington's My Health My Data Act is notable because it includes a private right of action, allowing individual consumers to sue for violations, which is rare among comprehensive state privacy laws that typically limit enforcement to the attorney general.

The claim about relying solely on the attorney general is wrong because the private right of action supplements state enforcement. The HIPAA exemption statement is incorrect because the Act only excludes HIPAA-regulated data, not entire covered entities. The revenue threshold option is wrong because the Act applies broadly based on consumer health data processing, not a fixed revenue cutoff.

Key concept: private right of action in state privacy statutes.

Question 2

A state comprehensive privacy statute grants consumers rights over their personal data and is enforced by the state attorney general with a cure period. A separate law in the same state focuses only on consumer health data and permits injured individuals to sue businesses on their own. An analyst compares the two frameworks to explain the enforcement gap. Which statement accurately captures the distinction between these two regimes?

Correct Answer: The health data law adds a private right of action, while the comprehensive statute relies on attorney general enforcement

The health data law empowers injured individuals to sue directly through a private right of action, while the comprehensive statute confines enforcement to the attorney general with a cure period, creating the described enforcement gap.

The option reversing these features misstates which regime allows lawsuits. The choice claiming neither offers a private remedy ignores the health data law's individual right to sue. The choice routing enforcement to a federal agency is wrong because both are state laws enforced at the state level, not federally.

Key concept: distinguishing private right of action from attorney general enforcement in state privacy laws.

Question 3

A startup is building a new fitness and reproductive-health tracking product for consumers in a state that regulates consumer health data outside of HIPAA. The founders want a compliance architecture that satisfies the state's consent and access framework before launch. Which design approach should the privacy lead build into the product?

Correct Answer: Require affirmative opt-in consent before any health data collection and build a portal for consumer access and deletion requests

State consumer health data laws like Washington's My Health My Data Act require affirmative opt-in consent before collecting or sharing consumer health data, plus consumer rights to access and delete, so building both features satisfies the consent and access framework.

A posted notice fails because these laws demand affirmative opt-in, not passive notice. Treating the product as a HIPAA covered entity is wrong because consumer apps fall outside HIPAA, which is precisely why the state law applies. Applying comprehensive privacy statute thresholds with opt-out advertising controls misses the heightened opt-in consent standard for sensitive health data.

Key concept: opt-in consent and access rights under non-HIPAA consumer health data laws.

More State consumer health data laws questions
27 questions (total)
Start 27 question test

Other State Privacy Laws concepts

Applicability thresholds and exemptions in state privacy lawsCalifornia CCPA as amended by the CPRACalifornia Consumer Privacy Act (CCPA) and CPRAConsumer rights common to the state comprehensive lawsFederal vs. State Authority and PreemptionKey Differences Among State Breach Notification LawsNYDFS Part 500 cybersecurity regulationOther Comprehensive State Privacy LawsRecent State Privacy Legislative DevelopmentsSensitive data and consent under state lawsState attorney general enforcement and cure periodsState biometric privacy lawsState Data Breach Notification Law ElementsState Security Procedures and Cookie RegulationsState SSN and Data Destruction LawsUniversal opt-out mechanismsVirginia Consumer Data Protection Act (VCDPA)
All State Privacy Laws questions · CIPP/US practice test