00:07
Adam Stofsky
Tora. Can you explain what is legally important health information outside the world of HIPAA? Like, if you're just a company that's not a healthcare provider, insurance company, what do you need to start worrying about? 

00:20
Thora Johnson
You need to start worrying about collecting any condition or diagnoses from individuals and then under some of these, more expansive so these three states that now have specific consumer health privacy laws, you need to think about it even beyond mere diagnoses and conditions. And in particular, I'm going to think and concentrate on my health, my data, which is Washington's new statute, and goes into effect in 2024. Predominantly there are a few provisions that go into effect earlier, but then you really have to think about it because their definition of health information is very expansive and includes things like bodily functions and measurements. And it is merely being able to relate it to an individual. Not that it's actually being used to target an individual. It doesn't just give Washingtonians rights, it gives any individuals whose information is collected in Washington rights under the statute. 

01:36
Adam Stofsky
So it's very broad. And that's when you need to start thinking about, well, is that newspaper stand in the airport subject to my health, my data? Because it's selling over the counter tylenol, and that's a story to be developed. Don't know where the regulator is going to land on that, but it's tricky because there's also a private right of action. So I suspect we'll see some testing. That means individuals can sue.