Does Washington's My Health My Data Act apply to your business?

Washington's My Health My Data Act is the health-data law that catches companies who assumed HIPAA was the only thing they had to worry about. It reaches far beyond hospitals and insurers, and it does something almost no other US privacy law does: it lets ordinary people sue you. If you collect anything that hints at a person's health and you touch Washington, the size of your business does not get you out of it.

Who does the My Health My Data Act cover?

The law applies to a "regulated entity," which RCW 19.373.010 defines as any legal entity that conducts business in Washington, or targets products or services to Washington consumers, and decides the purpose and means of collecting consumer health data. There is no revenue floor and no consumer-count trigger, so a small out-of-state app is covered the same as a large in-state one. Government agencies, tribal nations, and their contracted service providers sit outside it. A "small business" is a regulated entity that collects health data on fewer than 100,000 consumers a year, or earns under half its revenue from that data while handling fewer than 25,000 consumers. Small businesses get a later compliance date, not an exemption.

What is consumer health data?

This is the part that surprises people. Consumer health data is any personal information, linked or reasonably linkable to a consumer, that identifies their past, present, or future physical or mental health status. It includes conditions, diagnoses, treatments, and procedures, but also health-related purchases, precise location that could show someone sought care, and data that infers a health status from nonhealth signals. An app that logs period dates, a store that sells supplements, or an ad tool that guesses a pregnancy can all be handling consumer health data.

What do you have to do before collecting it?

The consent rule is strict and front-loaded. Before you collect consumer health data, you need a clear opt-in consent that is separate from any general terms of use, and you cannot bundle it into a broad agreement or infer it from silence. Before you share the data, you need a second, separate consent. Before you sell it, you need a signed valid authorization from the consumer. You also have to publish a consumer health data privacy policy under RCW 19.373.020 that lists the categories you collect, why, and who receives them, and honor consumer rights to access, withdraw consent, and delete.

Why this law carries unusual risk

Two features make it sharper than a typical state privacy law. First, RCW 19.373.080 bans using a geofence of 2,000 feet or less around a facility that provides in-person health care to track consumers, collect their health data, or send them health-related messages. Second, and more important, RCW 19.373.090 declares a violation an unfair or deceptive act under Washington's Consumer Protection Act, chapter 19.86 RCW. That gives individuals a private right of action, the same feature that makes Illinois BIPA so litigated. Health data also overlaps with California's rules, so review CCPA sensitive personal information if you serve consumers in both states.

Next step

If you collect anything that touches health and reach anyone in Washington, the free 2-minute Obligation Scan checks whether the My Health My Data Act applies and lists the consent, privacy-policy, authorization, and geofencing steps you owe, so a missing opt-in does not turn into a Consumer Protection Act claim. The US state privacy laws hub shows how data-type laws like this one sit alongside the comprehensive state laws.