Washington and Nevada were among states enacting new data privacy laws in 2024, and that trend among states will likely continue into 2025 as a reaction to the Trump presidential administration’s pledge to reduce federal regulations, said attorney Melissa Crespo of the law firm Morrison Foerster.
“First of their kind state laws went into effect this year that focused on consumer health data – Washington’s My Health My Data Act and Nevada’s SB370 went into effect this year, and they largely regulate the use and disclosure of consumer health data that is not covered by HIPAA,” she said in an interview with Information Security Media Group.
“I certainly expect more states to follow, and this is something that I’m keeping an eye on, especially in light of the new administration’s emphasis on reducing federal oversight, which we anticipate will impact privacy oversight,” she said.
“I think that a lot of states are going to start moving to fill in these gaps that may be introduced more at the federal level,” she said.
Some state legislatures indicate they will make efforts to enhance privacy around certain types of health information, such as reproductive health data, which might be “a target” for less protection by the new administration, she said.
“I think there are going to be a number of things to keep an eye on at both the federal and state level,” she said.
In the interview (see audio link below photo), Crespo also discussed:
- Other state data privacy and cybersecurity regulatory trends to watch in 2025;
- The Federal Trade Commission’s top regulatory and enforcement priorities for health data privacy;
- HIPAA audits, enforcement priorities and other developing regulatory issues for the incoming Trump administration.
Crespo is a privacy and data security attorney and partner at the law firm Morrison Foerster. She helps clients navigate challenging privacy compliance and data security matters with a focus on health information and the healthcare sector and has advised clients on compliance with the HIPAA and other laws governing the collection and use of medical and health information.