Gov. Inslee vetoes bipartisan COVID data privacy bill in Washington state

Washington state Gov. Jay Inslee has vetoed bipartisan legislation to protect personal COVID data from third parties, generating concern on both sides of the political aisle.

Lawmakers had passed House Bill 1127 to address data collection during the pandemic from contact tracing, the process by which investigators retrace an infected person's steps to when they first contracted the virus.

The bill would have made sure all digital tools used by the state's health care system to combat COVID would also boast privacy protections.

The legislation would have restricted third-party contractors from collecting or disclosing COVID-19 patient data for purposes in the public interest. It essentially stripped down data collection conducted by third parties to the least amount of personal information possible, supporters said.

Under the bill, all data collected by third-party groups would be destroyed after 30 days. The bill's provisions would expire by Dec. 31, 2022.

Inslee claimed the bill language was too broad and could hamper efforts to identify and incentivize residents to get COVID vaccinations.

"For example, this bill appears to prohibit efforts by public and private entities to offer incentives to become vaccinated or to make certain opportunities available to those persons who are vaccinated," Inslee said. "The current critical need to incentivize every eligible person to become vaccinated is an issue that did not exist, and was not contemplated, at the time this bill was drafted or made its way through the legislative process."

HB 1127 has seven sponsors, Republican and Democrat.

One of the bill's sponsors, Rep. Vandana Slatter, D-Bellevue, expressed disappointment with the veto.

"This was a tremendous bill and I'm so grateful to all the stakeholders who united with urgency to bring attention to this issue, protect personal data privacy, and strengthen public health during a pandemic," Slatter said. "I'm deeply disappointed it won't become law, but I am more committed than ever to making real progress on delivering innovative solutions to protect Washingtonians' privacy."

Contact tracing and other public health investigative work are routine practices in the medical field. They are subject to medical privacy laws like The Health Insurance Portability and Accountability Act of 1996 (HIPAA). The state's COVID alert app, WA Notify, has built-in privacy features.

The CDC's COVID Tracker showed on Wednesday that 41.3% of the state was fully vaccinated, and another 52.7% had received at least one dose.