Health Data Privacy Beyond HIPAA: My Health My Data

Most health data collected today never touches a HIPAA covered entity, so apps, retailers, wearables and advertisers handle sensitive health information under a different and stricter set of rules than many teams assume. Washington's My Health My Data Act, Nevada's consumer health data law and Connecticut's consumer health data amendments require opt-in consent to collect and share health data, a signed authorisation to sell it, and ban geofencing around health care facilities. The FTC's Health Breach Notification Rule, amended in 2024, treats an unauthorised disclosure to an advertiser as a breach. This guide explains what each regime covers, how they differ, and what security and privacy engineering teams must build: data inventories, consent gates, tag governance, rights handling and breach response. It is for privacy engineers, security architects and product teams at consumer-facing organisations, and for healthcare organisations whose data flows extend beyond HIPAA.

Key takeaways

HIPAA status does not settle the question. Health data held by an entity that is not a covered entity or business associate falls to state consumer health data laws, general state privacy laws and the FTC.
"Consumer health data" is defined very broadly. Washington's definition includes data inferred from non-health information, precise location that could indicate seeking care, and biometric and genetic data.
Consent must be separate and specific. Washington and Nevada require one consent to collect and a separate consent to share, and a signed authorisation that expires after one year to sell.
Tracking pixels are the main exposure. The FTC's first Health Breach Notification Rule action, against GoodRx, concerned health information shared with advertising platforms, and the 2024 amendments confirm that unauthorised disclosure is a breach.
Enforcement routes differ. Washington violations are enforceable by the Attorney General and through private action under the Consumer Protection Act; Nevada and Connecticut leave enforcement to the state with no private right of action.

Why HIPAA is not the boundary

HIPAA applies to covered entities (health plans, clearing houses and providers that conduct standard electronic transactions) and their business associates. It does not follow the data. A symptom tracker, a fertility app, a pharmacy discount service, a fitness wearable, a consumer genetics service or a retailer that infers pregnancy from purchases is usually outside it. Washington's Attorney General describes the My Health My Data Act as covering health data outside HIPAA, and each state law exempts protected health information already governed by HIPAA so the regimes do not overlap.

The practical consequence for security teams: the same data element (a medication name, a heart rate, a clinic visit) can be PHI in one system and consumer health data in another within the same group of companies. Classification must record the regime, not just the sensitivity. See the HIPAA Security Rule Guide for the covered entity side and the Data Classification Guide for labelling.

The laws at a glance

Element	Washington MHMDA (RCW 19.373)	Nevada (NRS 603A.400 to 603A.550, from SB 370)	Connecticut (CTDPA consumer health data provisions)
In force	31 March 2024; small businesses 30 June 2024	Enacted 2023, in force since 31 March 2024	Consumer health data amendments in force since 2023 (PA 23-56); broader CTDPA changes in PA 25-113 mostly from 1 July 2026
Who is covered	Regulated entities doing business in Washington or targeting Washington consumers	Regulated entities doing business in Nevada or targeting Nevada consumers	Consumer health data controllers doing business in or targeting Connecticut, regardless of the CTDPA volume thresholds
Scope of data	Data that identifies past, present or future physical or mental health status, including inferred data, precise location, biometric and genetic data	Data a regulated entity uses to identify past, present or future health status, including inferred data and precise geolocation	Personal data a controller uses to identify a physical or mental health condition or diagnosis, including gender-affirming and reproductive or sexual health data
Collection	Consent for a specified purpose unless necessary for a requested product or service	Affirmative, voluntary consent unless necessary for a requested product or service	Consent before processing
Sharing	Separate consent from collection consent	Separate consent from collection consent	Covered by consent and CTDPA processor rules
Sale	Signed valid authorisation, expires after one year, copies kept six years	Written authorisation, expires after one year, copies kept six years	Consent before selling
Geofencing ban	2,000 feet around in-person health care providers	1,750 feet around medical facilities and other in-person providers	1,750 feet around mental, reproductive or sexual health facilities
Response to rights requests	45 days, one 45-day extension; deletion reaches processors and third parties, backups within six months	45 days, one 45-day extension; deletion within 30 days, backups within two years	CTDPA consumer rights process
Enforcement	Per se Consumer Protection Act violation; Attorney General and private action	Deceptive trade practice; no private right of action	Attorney General, exclusive; no private right of action

Other comprehensive state privacy laws treat health information as sensitive data needing opt-in consent, and Connecticut's 2025 amendments extend its sensitive data definition to include disability or treatment, neural data and data derived from genetic or biometric data. See the US State Privacy Laws Guide.

Washington My Health My Data Act in detail

Definitions that drive scope

Consumer: a Washington resident, or a person whose consumer health data is collected in Washington, acting in an individual or household context. Data about employees in an employment context is excluded.
Consumer health data: includes health conditions, treatments and medication use; bodily measurements and vital signs; gender-affirming care and reproductive or sexual health information; biometric and genetic data; precise location that could reasonably indicate an attempt to obtain health services; data identifying someone seeking care; and data derived or extrapolated from non-health information, including by algorithms or machine learning.
Small business: a regulated entity that processes data of fewer than 100,000 consumers in a calendar year, or derives under 50 percent of gross revenue from consumer health data and processes data of fewer than 25,000 consumers.

Obligations by section

Section	Obligation	Engineering implication
19.373.020	Consumer health data privacy policy, linked prominently on the homepage; new categories or purposes need disclosure and fresh consent	A separate health data policy and a change process tied to data inventory updates
19.373.030	Consent to collect for a specified purpose; separate consent to share; disclosures of categories, purposes, recipients and withdrawal method	Consent records per purpose, enforced before tags, SDKs or APIs fire
19.373.040	Right to confirm, access (including list of third parties and affiliates), withdraw consent and delete	Request workflow with 45-day clock, deletion propagation to processors and third parties
19.373.050	Restrict access to those who need it; security meeting the reasonable standard of care for the industry	Least privilege, logging and encryption for health data stores
19.373.060	Processors act under a binding contract; a processor that strays becomes a regulated entity	Processor contracts and vendor reviews that cover SDKs and analytics providers
19.373.070	Sale only with a signed valid authorisation; invalid if expired, revoked, compound or conditioned	Detect data flows that meet the "sale" definition, including exchanges for non-monetary value
19.373.080	No geofence within 2,000 feet of an in-person health care provider to track, collect or advertise	Review location advertising and audience segments
19.373.100	Exemptions including HIPAA PHI, Washington health care information under chapter 70.02 RCW, 42 C.F.R. Part 2, GLBA, FCRA and FERPA data; processing for security and fraud prevention	Record the exemption relied on; the entity bears the burden of proving it applies

The Washington text reviewed for this guide shows only the original 2023 enactment (Laws of 2023, chapter 191) in each section's history.

Nevada and Connecticut: the differences that matter

Nevada geolocation threshold: "precise geolocation" means location within a 1,750-foot radius, and the geofence ban uses the same distance.
Nevada deletion clock: deletion within 30 days of authenticating a request, faster than the general 45-day response, with backup copies allowed up to two years.
Nevada rights: consumers can ask whether data is collected, shared or sold, for a list of third parties, to stop collection, sharing or sale, and for deletion; appeals must be answered in writing within 45 days with the Attorney General's contact details if refused.
Nevada enforcement: a violation is a deceptive trade practice, and the provisions expressly do not create a private right of action.
Connecticut coverage: consumer health data controllers are covered regardless of the CTDPA thresholds, and staff and contractors may access consumer health data only when bound by a contractual or statutory duty of confidentiality.
Connecticut 2025 changes: PA 25-113 lowers the general threshold to 35,000 consumers, brings in any controller that processes sensitive data, and requires separate consent to sell sensitive data, with most changes effective 1 July 2026.

Other states have passed or are considering health data bills, so confirm the current position for each state where you have users before relying on this table.

The FTC Health Breach Notification Rule

The Health Breach Notification Rule (16 C.F.R. Part 318) applies to vendors of personal health records, PHR related entities and their third party service providers that are not HIPAA covered entities or business associates. The FTC finalised amendments in April 2024 by a 3-2 vote; they were published on 30 May 2024 and took effect 60 days later, on 29 July 2024.

Element	Requirement
Personal health record	An electronic record of identifiable health information that has the technical capacity to draw information from multiple sources and is managed, shared and controlled by or primarily for the individual. The FTC says the rule clearly applies to health apps and similar technologies not covered by HIPAA.
Breach of security	Acquisition of unsecured PHR identifiable health information without authorisation, expressly including unauthorised disclosure; unauthorised access is presumed to be acquisition without reliable evidence otherwise
Individual notice	Without unreasonable delay and no later than 60 calendar days after discovery; email allowed where the individual chose it as the primary contact method
FTC notice	500 or more individuals: at the same time as individual notice. Fewer than 500: an annual log due within 60 days after the end of the calendar year
Media notice	Prominent media outlets where 500 or more residents of a state or jurisdiction are affected
Notice content	What happened including the identity of third parties that acquired the data, information types, protective steps, remediation, and at least two contact methods
Penalties	Treated as violation of a trade regulation rule under the FTC Act, with civil penalties

The FTC's first action under the rule, announced on 1 February 2023, was against GoodRx: the FTC alleged it shared users' prescription and health condition information with Facebook, Google, Criteo and others despite promising not to, and the proposed order included a $1.5 million civil penalty and a permanent ban on sharing health data for advertising. For notification across all regimes, see the Data Breach Notification Checklist.

Building a compliant health data architecture

Map health data: inventory every system, SDK, tag and data flow that collects or infers health status, including search terms, page URLs (a URL path like a condition page is health data in context), product purchases, location and wearable feeds. Record whether each is PHI, consumer health data or neither, and the state of the user.
Govern tags and SDKs: remove advertising pixels and session replay from pages and screens where health information is entered or implied, or gate them behind valid sharing consent. Server-side tagging helps you control exactly which fields leave, but it does not remove the need for consent.
Build consent gates: capture separate, purpose-specific consent for collection and for sharing, with timestamps, versioned wording and withdrawal. Enforce the gate in code so a missing consent blocks the data flow. See the Consent Management Guide.
Block sales by default: treat any exchange of health data for value, including data enrichment or audience building, as a potential sale until legal confirms otherwise, and keep signed authorisations for six years where sales occur.
Remove geofenced targeting: exclude health care facility audiences and location segments within 2,000 feet (the strictest threshold) of providers from campaigns.
Handle rights: extend the DSAR process to health data, with state-specific clocks (Nevada's 30-day deletion), deletion propagation to processors, and an appeals route. See the DSAR Guide.
Secure the data: restrict access by role, encrypt at rest and in transit, log access to health data stores and review it, and include health data in the incident response plan with the HBNR clocks.
Test and roll back: before launch, run a tag audit with a browser proxy against staging to confirm nothing fires before consent; keep a kill switch to disable a tag or SDK across all properties within hours if an unapproved flow is found.

Small versus large organisations

A small app developer may fall under Washington's small business definition, which delayed its start date, but not its obligations, and Connecticut covers consumer health data controllers of any size. The cheapest route for a small team is to avoid collecting health data it does not need and to run no third-party advertising tags in health flows. A large organisation needs a central inventory, a consent platform integrated with tag management and a vendor contract programme that covers every SDK.

Where identity fits

Health data leaks as often through credentials and integrations as through tags. Analytics, CDP and advertising integrations run on API keys and service accounts that can pull audience data in bulk; scope them to the minimum fields and rotate them. Customer account security matters too: consumer genetics and health accounts attract credential stuffing, as the 23andMe breach showed when access to about 18,000 accounts exposed DNA Relatives data on almost 7 million people. Genetic data is consumer health data under Washington's definition. See the Healthcare Identity Security Guide.

Detection and measurement

Tag drift: number of third-party tags or SDK endpoints firing on health pages or screens without an approved record, from automated scans (target zero).
Consent coverage: percentage of health data records with a valid, current collection consent, and of shared records with a separate sharing consent.
Rights request timeliness: percentage of health data requests closed within the state clock, with Nevada deletions tracked against 30 days.
Processor coverage: percentage of vendors receiving health data with a signed processing contract that meets the state requirements.
Access review: number of people and service accounts with access to health data stores, and the trend after quarterly reviews.
Breach readiness: time from detection of an unauthorised disclosure to a notification decision, measured in exercises against the 60-day HBNR limit.

Common failure patterns

Assuming "not HIPAA" means unregulated: product teams launch health features with general marketing consent and no separate health data policy.
Pixels on health pages: advertising and analytics tags capture condition names, medication searches or appointment pages, the pattern behind the GoodRx action.
Ignoring inferred data: treating only fields labelled "health" as in scope, while models infer conditions from purchases or behaviour, which Washington explicitly covers.
One consent for everything: bundling collection, sharing and sale into one checkbox, when Washington and Nevada require separate consent and a separately signed authorisation for sale.
Location data in ad audiences: buying or building audiences around clinics without checking the geofence distances.
Weak customer authentication on sensitive accounts: optional MFA on services holding genetic or health data, as in the 23andMe breach.

Framework mapping

Framework	Reference	Relevance
NIST CSF 2.0	GV.OC-03	Legal and regulatory requirements, including privacy obligations, are understood and managed
NIST CSF 2.0	ID.AM-07	Inventories of data and metadata for designated data types are maintained
NIST CSF 2.0	PR.DS-01, PR.DS-02	Protection of data at rest and in transit
NIST SP 800-53 Rev. 5	PT-3, PT-4, PT-5, PT-7	Processing purposes, consent, privacy notice and specific categories of PII
NIST SP 800-53 Rev. 5	AC-21, SR-6	Information sharing decisions and supplier assessments
NIST SP 800-53 Rev. 5	SI-12	Information management and retention
ISO/IEC 27001:2022 Annex A	A.5.34	Privacy and protection of PII

Practitioner checklist

Inventory every flow that collects or infers health status, and record whether it is PHI, consumer health data or out of scope.
Publish a separate consumer health data privacy policy linked from the homepage where Washington applies.
Implement separate, recorded consent for collection and for sharing, enforced in code before data leaves.
Remove or consent-gate advertising pixels, SDKs and session replay on health pages and screens.
Prohibit sale of health data unless a signed authorisation is in place, and retain authorisations for six years.
Exclude health facility geofences from advertising, using the 2,000-foot Washington distance as the floor.
Extend rights handling to health data with state-specific clocks and deletion propagation to processors.
Bind processors and SDK providers by contract to processing instructions.
Add HBNR timelines and FTC, individual and media notification steps to the incident response plan.
Require MFA and credential stuffing defences on customer accounts that hold health or genetic data.

Standards and references

Related NHI Mgmt Group resources: HIPAA Security Rule Guide · US State Privacy Laws Guide · AI and Privacy Guide · Insider Threat Programme Guide. This guide summarises US consumer health data privacy laws and the FTC Health Breach Notification Rule as at 24 October 2026 and is not legal advice.

Health Data Privacy Beyond HIPAA Guide: My Health My Data and State Laws