Health data privacy in the United States works like a kaleidoscope does. The same piece of information (i.e., a person's heart rate) changes character depending on how you turn the lens. Collected by a hospital, and it’s protected health information under HIPAA. Entered into a fitness app, and it becomes consumer health data under Washington's My Health My Data Act. Processed by a company in California, it’s sensitive personal data under the CCPA. The data never changes, but the legal frame around it does.
In a recent Axiom CLE, privacy attorneys Ava Crayton and Nicole Martin walked through these overlapping frameworks, discussing where the Washington My Health My Data Act sits among them, and what legal teams should be doing about it.
What Is the Washington My Health My Data Act?
Washington enacted the My Health My Data Act in 2023, and it went into effect on March 31, 2024. It’s the first law in the US to target consumer health data privacy specifically, and it applies to businesses that conduct business in Washington or target Washington residents.
The act's requirements are substantial. Covered businesses must post a consumer health data privacy notice and obtain affirmative consent before collecting consumer health data and again before sharing any consumer health data with a third party. Geofencing around health-related facilities is prohibited outright. Businesses must maintain administrative and technical safeguards, execute contracts with consumer health data processors, and honor consumer rights that mirror those in comprehensive data privacy laws, including the rights to access, delete, withdraw consent, appeal, and be free from discrimination for exercising those rights.
Why Did Washington Pass the My Health My Data Act?
The short answer is a gap. The Health Insurance Portability and Accountability Act (HIPAA) protects health information held by covered entities and their business associates. But it doesn’t reach the enormous volume of health-related information that consumers hand over every day outside of healthcare settings. Your fitness tracker, your meditation app, your pharmacy delivery order, and your skincare quiz all generate health data, and none of it is protected health information under HIPAA.
The My Health My Data Act was designed to protect exactly that data. As Ava explained during the CLE, consumer health data is so broadly defined that it really includes anything. For example, simply informing a restaurant reservation app that you have a nut allergy creates consumer health data.
Understanding why these laws exist is the first step toward stronger health data governance.
Who Must Comply?
The My Health My Data Act applies to businesses that conduct business in Washington or target Washington residents with their products or services. And the second prong matters: a company with no office in the state can still be covered if it markets to or serves Washington consumers, which describes most companies operating online.
What Counts as Consumer Health Data?
Consumer health data is any personal data that is linked (or reasonably linkable) to a consumer and identifies their past, present, or future physical or mental health status. It is typically collected outside of healthcare settings, and the examples from the CLE show how far the definition stretches.
Heart rate readings a consumer enters into a wearable qualify. So does a response to a cosmetic retailer's online form asking about skin conditions, in which the consumer indicates they suffer from acne or rosacea. A delivery app that brings reproductive health products to someone's door handles consumer health data, and so does a dining app that stores a note about a severe nut allergy. Even information entered into wellness apps like Calm counts, since those companies are neither covered entities nor business associates under HIPAA.
And inferences count, too. Ava walked through the now-famous retail example: A customer uses a rewards program to buy cocoa butter lotion, a plush toy, and folic acid, iron, and calcium supplements. The retailer, drawing on her purchase history, infers she is pregnant and starts sending coupons for prenatal vitamins and cribs. That inference is consumer health data, and under laws like Washington's, businesses cannot sell or share sensitive personal data, including consumer health data, or draw inferences from it without specific consent.
Washington My Health My Data Act vs. HIPAA
These two laws are answering different questions. HIPAA asks who holds the data. The My Health My Data Act asks what the data is.
Under HIPAA, protected health information is individually identifiable health information relating to a person's past, present, or future physical or mental health, care, or payment for care, and it is only regulated when maintained or transmitted by covered entities or their business associates. Covered entities are health plans, healthcare clearinghouses, and certain healthcare providers. Business associates are the vendors and service providers that access protected health information on their behalf. HIPAA obligations include permitted uses and disclosures, valid authorizations, the minimum necessary standard, access rights, risk analysis, business associate agreements, and breach notification.
The My Health My Data Act picks up where HIPAA stops. If the same health information sits with a wellness app instead of a hospital, HIPAA is silent, and Washington's law speaks.
But some organizations wear both hats. The CLE offered the example of a medtech family of companies where one entity makes diabetes monitoring devices and is a HIPAA-covered entity, while an affiliate that conducts research and development, holds consumer health data and is subject to consumer health data laws instead. Hybrid entities have to comply with both regimes, which makes training personnel to recognize the difference between protected health information and consumer health data a practical necessity.
Washington My Health My Data Act vs. Other State Privacy Laws
California CCPA/CPRA
The California Consumer Privacy Act was the first personal data privacy law in the US and remains the foundation of the state law framework. California treats health information as sensitive personal data within a comprehensive privacy law rather than through a standalone health data statute. California also enforces aggressively. The state attorney general fined one retailer $1.2 million for failing to disclose the sale of consumer data, improperly handling user data through third-party tracking, and failing to honor global privacy controls. In 2026, the AG announced a $12.75 million settlement with an automotive company over the sale of driver location and telematics data to data brokers in violation of the CCPA.
Experienced CCPA counsel help legal teams translate regulatory complexity into practical action.
Connecticut, Colorado, Virginia, Oregon, and Other State Privacy Laws
Twenty states have now enacted data privacy laws, and most define consumer health data as sensitive personal data requiring heightened protection. A few have gone further. Nevada passed its own Health Data Privacy Act. Virginia amended its Consumer Data Protection Act to require opt-in consent for processing consumer health data and expanded its definition of reproductive or sexual health information to include purchasing data, bodily functions and hormone measurements, derived and inferred data, and location data that suggests an attempt to obtain reproductive or sexual health services. Connecticut amended its Data Privacy Act to regulate consumer health data controllers with strict processing rules, and Maryland's Online Data Privacy Act restricts the collecting and sharing of consumer health data. Colorado and Oregon both treat data revealing a mental or physical health condition or diagnosis as sensitive data under their comprehensive privacy laws, requiring opt-in consent before processing. More is coming, with Oklahoma and Alabama laws taking effect in 2027.
Washington Data Breach Law
Washington also maintains one of the strictest data breach notification laws in the country. Under RCW 19.255, businesses must notify affected Washington residents within 30 days of discovering a breach of personal information, one of the shortest deadlines of any state, and must notify the state attorney general when a breach affects more than 500 Washington residents. The state's definition of personal information is notably broad and explicitly covers health insurance IDs, medical records, and biometric data, which means the categories of information regulated by the My Health My Data Act are exactly the kind that trigger breach obligations when exposed.
Experienced breach counsel help legal teams prepare for risks before they escalate.
The CLE's enforcement examples show what those stakes look like in practice. A Maryland software company serving as a business associate settled with the Office for Civil Rights after an unauthorized actor accessed the protected health information of roughly 15 million individuals, some of it appearing on the dark web. A self-funded employee benefits plan paid $245,000 after a ransomware attack exfiltrated protected health information, and OCR found it had never conducted a thorough risk analysis. The same themes surface again and again in these actions. Regulators keep finding data disclosed without permission, systems accessed by people who should never have gotten in, ransomware that organizations were unprepared for, consumer access requests that went ignored, and risk analyses that were never conducted in the first place.
FAQ
What is the Washington My Health My Data Act?
A Washington state law, effective March 31, 2024, that protects consumer health data not covered by HIPAA. It requires consent for collection and sharing, prohibits geofencing, and gives consumers rights over their health data.
What does the Washington My Health My Data Act protect?
Consumer health data, meaning any personal data linked or reasonably linkable to a consumer that identifies their past, present, or future physical or mental health status, including inferences drawn from other data.
Why was the Washington My Health My Data Act passed?
To close the gap left by HIPAA, which only covers health information held by covered entities and business associates. Health data collected by apps, wearables, retailers, and other consumer-facing businesses had no dedicated protection.
Is the Washington My Health My Data Act a healthcare privacy law or a consumer privacy law?
A consumer privacy law. It regulates health data based on what the data is rather than who holds it, and it primarily reaches businesses outside of traditional healthcare.
Does the Washington My Health My Data Act apply outside Washington?
Yes, in effect. It applies to any business that conducts business in Washington or targets Washington residents, regardless of where the business is located.
Who must comply with the Washington My Health My Data Act?
Businesses that operate in Washington or offer products or services targeted at Washington consumers and that collect, process, or share consumer health data.