Washington's Office of the Attorney General updated its FAQs for the My Health My Data Act this week to address when the use of non-prescription medication may be considered consumer health data:

Does the definition of consumer health data include the purchase of non-prescription medication?

MHMD defines consumer health data to include the “use and purchase of prescribed medication.” Non-prescription data is only considered consumer health data if the regulated entity draws an inference about a consumer’s health status from its purchase of non-prescription medication.

This clarifies an inconsistency in the definition of consumer health data.  Consumer health data is defined to include a laundry list of items, one of which is the use and purchase of “prescription medication.”  However, the definition also includes data that identifies a consumer as seeking “health care services,” and “health care services” includes the use or purchase of “medication” (not limited to prescriptions). Under the statutory language, a search for Tylenol could arguably be considered consumer health data, despite the earlier reference to prescription medication.  This FAQ appears to clarify that inconsistency.

While this clarification may not move the needle on the class action risk, it gives some helpful color on how the OAG interprets the definition of consumer health data.