Washington's My Health My Data Act turns health-adjacent data that HIPAA never touched, from app activity to location near a clinic, into regulated consumer health data with opt-in consent, a signed authorisation to sell, and enforcement through the state Consumer Protection Act. The Act (Chapter 191, Laws of 2023, codified as chapter 19.373 RCW) applies to companies anywhere that do business in Washington or target Washington consumers, and its definitions reach inferred and derived data, not just records a person typed in. Compliance has been due since 31 March 2024 for most regulated entities and 30 June 2024 for small businesses, and the first class action was filed in February 2025. This guide is a single-law deep dive for privacy engineers, security and data teams, and product owners: what counts as consumer health data, the separate consents, the sale authorisation, the geofencing ban, how enforcement works, and what it means for SDKs, data pipelines and AI agents. For the wider landscape of state health privacy laws, see the Health Data Privacy Beyond HIPAA Guide (My Health My Data).
Key takeaways
- Two consents, not one: collecting consumer health data needs consent for a specified purpose (or strict necessity for a requested service), and sharing it needs a second consent that is separate and distinct from the first.
- Selling needs a signed authorisation: a valid authorisation names the buyer and seller, the specific data and purpose, expires one year after signing, and both parties keep copies for six years.
- Geofencing near care is banned: no virtual boundary of 2,000 feet or less around an in-person health care provider may be used to identify or track people seeking care, collect health data, or send health-related messages or ads.
- Inference counts: health status inferred or derived from non-health data, such as purchases or precise location within 1,750 feet, is consumer health data.
- Consumers can sue: a violation is a per se unfair or deceptive act under the Consumer Protection Act, enforced by the Attorney General and through private action.
Scope: who and what is covered
The Act protects "consumers": Washington residents, and anyone whose consumer health data is collected in Washington, acting in an individual or household context. People acting in an employment context are excluded. It binds "regulated entities", meaning legal entities that conduct business in Washington or produce products or services targeted to Washington consumers and that, alone or jointly, determine the purposes and means of processing consumer health data. Government agencies, tribal nations and their contracted processors are excluded. The Attorney General's guidance adds that merely storing data in Washington does not make a company a regulated entity, while out-of-state processors working for a regulated entity must comply, and any "person" must comply with the sale and geofencing sections.
| Term | Statutory meaning (summarised) | Practical examples |
|---|---|---|
| Consumer health data | Personal information linked or reasonably linkable to a consumer that identifies past, present or future physical or mental health status, including data inferred or derived from non-health information | Symptom searches, medication purchases, fertility or period tracker entries, reproductive or gender-affirming care information, biometric and genetic data |
| Precise location | Location that identifies a consumer within a radius of 1,750 feet | App GPS and fine location data that could show a visit to a clinic |
| Collect | Buy, rent, access, retain, receive, acquire, infer, derive or otherwise process | Model outputs that derive health status count as collection |
| Share | Release or make available to a third party or affiliate, with exclusions for processors and certain transfers | Sending events to an ad network or data broker |
| Sale | Exchange for monetary or other valuable consideration, with exclusions for processors and mergers | Data licensing, data-for-services swaps |
| Small business | Processes data of fewer than 100,000 consumers in a calendar year, or derives under 50% of gross revenue from consumer health data and processes data of fewer than 25,000 consumers | Later compliance date only; the duties are the same |
What is exempt
The exemptions in section 12 are data-level, not entity-level for the most part. They cover protected health information under HIPAA, health care information under chapter 70.02 RCW, 42 CFR Part 2 records, human subjects research data, certain quality improvement and peer review records, de-identified data derived from HIPAA data, and information held by covered entities and facilities when intermingled with exempt data. Data governed by the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act and FERPA is also exempt. Processing to prevent or respond to security incidents, fraud or illegal activity, or to preserve system integrity, is permitted, but the entity carries the burden of showing an exemption applies. A hospital's patient portal may sit outside the Act while the same hospital's marketing website pixel data sits inside it.
Key obligations
| Section | Obligation | Engineering and security implication |
|---|---|---|
| 4: Privacy policy | A consumer health data privacy policy disclosing categories collected, sources, purposes, categories shared, categories of third parties and specific affiliates, and how to exercise rights; prominently linked from the homepage; new categories or purposes need disclosure and consent first | Data inventory must be accurate enough to list categories and specific affiliates |
| 5: Consent | Consent before collection for a specified purpose; separate and distinct consent before sharing; request discloses categories, purposes, recipients and how to withdraw; no discrimination for exercising rights | Consent state must gate data flows, not just be recorded |
| 6: Rights | Confirm and access data, including a list of all third parties and affiliates with contact details; withdraw consent; delete, including archives and backups, and pass deletion to processors and third parties | Lineage and recipient logs per consumer; backup deletion within six months of authenticating the request |
| 6: Timelines | Respond within 45 days, extendable once by 45 days with notice; appeals answered in writing within 45 days, with a route to the Attorney General if denied; free up to twice a year | Request tracking with service level timers |
| 7: Access and security | Restrict access to employees, processors and contractors who need it for the consented purpose; administrative, technical and physical practices meeting a reasonable standard of care for the industry | Role-based access, logging and encryption for health data stores |
| 8: Processors | Binding contract with processing instructions; processor assists with obligations; a processor that goes beyond instructions is treated as a regulated entity | Contract review for SDKs, analytics and AI vendors |
| 9: Sale | Valid signed authorisation, separate from consents, with nine required elements and a one-year expiry; copy to the consumer; six-year retention by seller and purchaser | Most organisations decide not to sell rather than build this |
| 10: Geofencing | No geofence of 2,000 feet or less around in-person health care providers to track, collect or message | Review ad targeting and location features for health venue boundaries |
What valid consent looks like
The Act defines consent as a clear affirmative act signifying a freely given, specific, informed, opt-in agreement. It cannot be obtained by accepting general terms of use, by hovering over, muting, pausing or closing content, or through deceptive design. In practice that means a dedicated screen or dialog for each consent, plain description of the categories and recipients, and a withdrawal route as easy as the grant. See the Consent Management Guide: Cookies, CMPs and GPC for implementation patterns, noting that a cookie banner alone rarely satisfies the separate sharing consent.
The sale authorisation in detail
A valid authorisation is written in plain language and contains: the specific consumer health data to be sold; the name and contact information of the seller and of the purchaser; the purpose of the sale, including how the data will be gathered and used by the purchaser; a statement that goods or services cannot be conditioned on signing; a statement of the right to revoke at any time and how; a statement that sold data may be redisclosed and may no longer be protected; an expiration one year from signing; and the consumer's signature and date. It is invalid if expired, incomplete, revoked, combined with other documents, or conditioned on signing.
Timeline and current status
| Date | Milestone |
|---|---|
| 17 April 2023 | Passed by the Legislature |
| 27 April 2023 | Signed into law |
| 23 July 2023 | Act effective; the geofencing ban in section 10 applies to all persons from this date, per the Attorney General |
| 31 March 2024 | Sections 4 to 9 apply to regulated entities that are not small businesses |
| 30 June 2024 | Sections 4 to 9 apply to small businesses |
| 10 February 2025 | First class action under the Act filed in the US District Court for the Western District of Washington |
| 30 September 2030 | Joint legislative committee report on Attorney General and consumer enforcement due under section 13 |
As of November 2026 the Attorney General's guidance page describes the original 2023 Act. Check the current RCW chapter for later amendments before relying on a specific provision.
Enforcement and penalties
Section 11 declares that the practices covered by the Act are matters vitally affecting the public interest for the purpose of applying the Consumer Protection Act, chapter 19.86 RCW, and that a violation is an unfair or deceptive act in trade or commerce and an unfair method of competition. Two consequences follow.
- Attorney General enforcement: the Attorney General can bring actions under the Consumer Protection Act, with the civil penalties and remedies that Act provides. The Act itself sets no separate penalty amounts, so check chapter 19.86 RCW for current figures.
- Private action: the Attorney General's guidance says the Act is enforced through private action as well. Commentary on the first case notes that a plaintiff relying on the Consumer Protection Act must still show injury to business or property and a causal link, which shapes how claims are pleaded.
- The first class action: filed on 10 February 2025, it alleged that an advertising software development kit embedded in third-party apps collected precise location data and advertising identifiers that could reveal health information, without notice or a separate choice about sharing. Whatever the outcome, it shows where plaintiffs look first: SDKs, location data and the absence of a distinct sharing consent.
The practical risk is aggregate: per-consumer claims across a large user base, plus legal costs, plus the reputational cost of being the test case. The Location Data Privacy Guide covers related location risks.
What it means for AI agents and non-human identities
- Models can create consumer health data: because "collect" includes inferring and deriving, a recommendation model or AI assistant that infers pregnancy, a condition or a medication need from browsing or purchase data creates regulated data. Treat model outputs as data categories in the privacy policy and consent flows.
- Agents are processors' tools, and need scoped access: section 7 limits access to those who need it for the consented purpose. An AI agent with a service account that can query every customer table defeats that. Give agents their own identities, restrict them to the data the consented purpose needs, and log their queries.
- Third-party AI APIs are sharing or processing: sending prompts containing consumer health data to an external model provider is either processing under a binding contract (section 8) or sharing that needs separate consent. Decide which, document it, and check the provider's retention and training terms.
- SDK and pipeline credentials matter: API keys for analytics and ad SDKs are the channel through which sharing happens. Inventory them, map each to a recipient listed in the privacy policy, and revoke keys for recipients that consent no longer covers.
- Deletion must reach machine stores: vector databases, feature stores, training sets and agent memory are archived systems for deletion purposes. Plan how a deletion request propagates to them.
See the Identity Data Privacy and Consent Guide for consent records linked to identity.
Compliance steps
- Find the data. Inventory every source of possible consumer health data, including inferred data, location data and data reaching SDKs, pixels and AI services. Mark which items are exempt (for example HIPAA PHI) and why.
- Decide on sale and geofencing. Most organisations choose not to sell and remove any health venue geofences; record the decision and the technical controls that enforce it.
- Write the consumer health data privacy policy. Separate from the general privacy notice, linked prominently from the homepage and app settings, listing categories, sources, purposes, recipients and specific affiliates.
- Build two consents into the product. Gate collection and sharing on separate consent states, enforced at the tag manager, SDK initialisation and server-side event pipeline, with easy withdrawal.
- Stand up rights handling. Access, recipient lists, withdrawal and deletion including backups, with 45-day timers, one 45-day extension with notice, and a written appeals process.
- Tighten access and security. Restrict health data stores to need-to-know roles and named service identities, encrypt them, and log access.
- Paper the processors. Put binding contracts with instructions in place for every processor, including AI and analytics vendors, and stop any flow that has neither a contract nor consent.
- Test. Run traffic captures on the website and apps with consent denied and confirm no health-related events leave. Repeat after each release.
Measuring it
- Consent enforcement rate: percentage of releases where consent-denied traffic captures show zero health events to third parties.
- Rights request timeliness: share of requests closed within 45 days, and extensions used.
- Recipient list accuracy: third parties observed in traffic and contracts that are missing from the privacy policy, target zero.
- Deletion reach: share of systems, including backups and AI stores, covered by the deletion workflow.
- Privileged access to health stores: number of human and machine identities with read access, trending down.
Framework mapping
| Act requirement | NIST SP 800-53 Rev 5 | NIST CSF 2.0 |
|---|---|---|
| Consent to collect and share (s5) | PT-4 Consent | GV.PO-01 |
| Privacy policy and notice (s4) | PT-5 Privacy Notice | GV.PO-01 |
| Access restriction (s7) | AC-6 Least Privilege | PR.AA-05 |
| Security practices (s7) | SC-28 Protection of Information at Rest | PR.DS-01 |
| Processor contracts (s8) | SA-9 External System Services | GV.SC-05 |
Common failure patterns
- Bundled consent: one checkbox for collection, sharing and marketing fails the separate and distinct test.
- Consent recorded but not enforced: the banner stores a choice while SDKs initialise anyway.
- Ignoring inference: teams scope only explicit health fields and miss model outputs and segment labels.
- Stale recipient lists: the access right requires a list of all third parties and affiliates; new marketing tools quietly break it.
- Backups forgotten: deletion that stops at production databases misses the six-month backup limit.
Practitioner checklist
- Inventory consumer health data, including inferred data and precise location, and record exemptions with reasons.
- Publish a separate consumer health data privacy policy linked from the homepage and app.
- Enforce separate collection and sharing consents in code, with withdrawal as easy as the grant.
- Remove or block geofences within 2,000 feet of in-person health care providers.
- Decide on sale; if selling, implement the nine-element authorisation and six-year retention.
- Run rights requests on 45-day timers with a written appeals route.
- Propagate deletion to backups, processors, third parties and AI stores.
- Scope service accounts, SDK keys and AI agent identities to consented purposes and log their access.
- Test consent-denied traffic on every release.
Standards and references
- Washington State Legislature: ESHB 1155, Washington My Health My Data Act (Chapter 191, Laws of 2023)
- Washington State Office of the Attorney General: Protecting Washingtonians' Personal Health Data and Privacy
- WilmerHale: First Lawsuit Filed Under Washington's My Health My Data Act
- NIST: SP 800-53 Rev 5, Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- US Department of Health and Human Services: HIPAA Security Rule
Related NHI Mgmt Group resources: Health Data Privacy Beyond HIPAA Guide (My Health My Data) · US State Privacy Laws Guide · Location Data Privacy Guide · FTC Health Breach Notification Rule Guide. This guide summarises the Washington My Health My Data Act and is not legal advice.