Which states have consumer health data privacy laws?

Most founders think health privacy means HIPAA, and that if they are not a hospital or insurer they are clear. Three states have proven that wrong. Washington, Nevada, and Connecticut each passed a consumer health data law that reaches ordinary apps, wearables, and websites, with no medical-provider requirement and, in most cases, no size threshold. If you touch data that hints at someone's health, these laws can apply to you. Our MHMDA vs HIPAA comparison shows which health data HIPAA leaves uncovered.

Which states regulate consumer health data?

Three do, through dedicated statutes that sit outside their general privacy laws. Washington's My Health My Data Act was the first and is the broadest. Nevada's SB 370 followed a close model. Connecticut added consumer health data rules to its existing privacy framework. Other states regulate health data only inside their comprehensive laws or biometric statutes; these three are the standalone consumer health data regimes in force today.

What these laws have in common

All three define consumer health data broadly. It is personal data that identifies a person's physical or mental health, and it expressly includes information inferred from non-health signals such as purchases or location, so a period-tracking app or a search for a clinic can qualify. All three require clear opt-in consent before you collect that data, and a separate consent before you share it. And all three ban geofencing: you cannot draw a virtual boundary around a health facility to track people, gather their health data, or send them related messages. None of the three depends on how much revenue you earn or how many users you have.

How they differ

The sharpest difference is enforcement. Washington makes a violation an unfair or deceptive act under its Consumer Protection Act, which gives individuals a private right of action and makes class exposure real. Nevada and Connecticut are enforced by the state attorney general, with no private suit. The geofence distances differ too: Washington uses a 2,000-foot boundary, while Nevada and Connecticut use 1,750 feet. Effective dates also vary, with Washington's duties phased in during 2024, Nevada effective March 31, 2024, and Connecticut's health-data rules effective October 1, 2023. To sell health data, Nevada requires a signed, revocable written authorization.

Next step

If you collect anything that could reveal a user's health, the free 2-minute Obligation Scan checks your footprint against these three state laws and flags where consent, a privacy policy, or a geofence review is missing. The US state privacy laws hub covers the comprehensive laws that may apply alongside them.