Washington State Considers Guardrails for COVID-19 Data

No stranger to reviewing data privacy bills, the Washington state Legislature is in the process of reviewing new legislation aimed at safeguarding COVID-19 health data.

House Bill 1127, which was passed in the state’s House of Representatives last week, now sits with the Senate, where, if passed, it would establish guidelines for organizations that collect and analyze novel coronavirus health data. 

These guidelines would include: 

• Limiting the data collected by organizations such as hospitals, physicians’ offices and medical research facilities for public health purposes
• Prohibiting the use of data for commercial, advertising, policing or immigration enforcement 
• Allowing citizens to opt in and out of organizations collecting their health data
• Requiring organizations to destroy any collected health data after 30 days

According to Rep. Vandana Slatter, D-Bellevue, the bill will also examine how public health data from contact tracing apps is being used. 

“These apps use Bluetooth and other location technologies to notify you if you’ve been exposed to someone who has tested positive for COVID-19,” Slatter said. “The biggest barrier in turning on these apps is a lack of trust in government and big tech.”

Slatter said the data collected by this type of technology should only be used to save lives.

One way to achieve this, according to Rep. Matt Boehnke, one of the bill’s co-sponsors, is by having clear and transparent language within the bill to protect citizens’ data. 

“My background is in cybersecurity, so for me defining where the data is going, where it is being stored and how long the data is being held for was very important,” Boehnke said. 

As a result, he and the bill’s other co-sponsors worked together to add “strong, clear and transparent language” to define and address these issues.  

“This bill ensures that data collected to combat the pandemic is not used for other purposes,” Rep. Shelley Kloba, another of the bill’s sponsors, said in an email to Government Technology. “It focuses on the fact that certain types of data, like our health information, need to have a higher level of protection that is afforded by a data collection policy that requires unambiguous, specific, freely given, affirmative consent.”

If the bill is passed, Rep. Boehnke said, the next step would be working with local counties to create a standardized approach to sharing data between the different counties and the state. 

“We cannot have gaps in data,” Boehnke said. “By standardizing and coming up with a uniform approach to how data is shared, we can prevent these gaps from happening.”