Virginia Leads U.S. Closer to National Consumer Data Laws

Last month Virginia joined California as the second U.S. state to enact comprehensive data privacy legislation—the Virginia Consumer Data Protection Act (CDPA). States are moving towards uniformity around privacy laws beyond HIPAA—mimicking Europe’s General Data Protection Regulation (GDPR). U.S.-based health tech companies should be preparing for the likelihood that we will see a similar national consumer data privacy law.  It’s not a question of “if” but rather “when.” Federal data privacy bills introduced in Congress this year and are gaining more momentum than ever before. 

“Privacy by design” approaches—where Health Tech companies anticipate early and incorporate thorough consumer rights and business obligations into their product and business model—will be key in becoming a market leader. Proactive efforts to align with these emerging privacy landscapes will save your company money and resources down the road, and help you avoid the onerous and expensive task of retrofitting later on.  These laws are complex, so work with experts at Elevation if you do not have a regulatory team in house or if your in-house team is spread thin.  To understand the direction of U.S. privacy laws, which are being lead currently through state-based efforts, start with state regulations in California and Virginia.  Below is an overview of the rights and obligations seen in both the California and Virginia privacy laws.