HIPAA protects health information held by covered entities and their business associates, but much of the information direct-to-consumer health brands collect may fall outside that framework. The Washington My Health My Data Act addresses some of that gap, extending privacy requirements to consumer health information collected through websites, marketing campaigns, and other nonclinical interactions. For brands already familiar with HIPAA compliance, this creates a separate set of questions about data collected before a patient enters care.
Washington's law, codified at RCW 19.373, became applicable to most regulated entities on March 31, 2024, and to qualifying small businesses on June 30, 2024. Its geofencing restrictions are generally read as taking effect earlier, on July 23, 2023. The six questions below help health brands determine whether their data practices may fall within the law and what obligations deserve closer examination.
Washington My Health My Data Act: The Six Questions at a Glance
| Question | If yes | If no |
|---|
| Do you collect data from Washington consumers? | The law may apply, even if you are based elsewhere | The law likely does not govern that activity |
| Is it consumer health data? | Check whether an exemption applies | This definition likely does not cover it |
| Is it already PHI under HIPAA? | That information is exempt | Washington's requirements may apply |
| Are you a small business under the Act? | Still covered; your compliance date was June 30, 2024 | Still covered; your compliance date was March 31, 2024 |
| Do you have separate consent for collecting and for sharing? | That collection and sharing may be compliant | Change the workflow before collecting or sharing more data |
| Do you geofence near healthcare facilities? | Stop if it tracks, collects data from, or targets people seeking care | The geofencing ban does not apply, but other duties still do |
Do You Collect Data From Washington Consumers?
If yes: When your business collects consumer health data from Washington residents or from individuals whose consumer health data is collected while they are in Washington, the law may apply even when your company operates elsewhere.
Under the Washington My Health My Data Act, a consumer includes a Washington resident or an individual whose consumer health data is collected in Washington. The definition applies to people acting in an individual or household capacity, not an employment context.
The statute defines a regulated entity as a business that operates in Washington or offers products or services targeted to Washington consumers and determines, independently or jointly, how consumer health data is collected, processed, shared, or sold.
For a telehealth brand, the relevant activity may begin before a clinical relationship exists. A prospective customer might complete a health-related questionnaire, browse treatment options, or interact with an advertising campaign while located in Washington.
A white-label setup can complicate responsibilities because multiple companies may participate in collecting and processing information. A brand may control its marketing questionnaire while another organization operates the clinical platform, and their legal roles depend on what each actually does with the data. Under the Act, a company that handles consumer health data on another company's behalf is a processor. It may do so only under a binding contract and under the other company's instructions, and a processor that goes beyond those instructions is treated as a regulated entity for that data.
If no: When your business has no relevant connection to Washington consumers and does not otherwise fall within the statute's scope, the law may not govern those activities. However, the location of your headquarters is not the deciding factor by itself.
The next question is whether the information you collect qualifies as consumer health data.
Is It Consumer Health Data?
If yes, or if you are unsure: Consumer health data reaches beyond medical records, prescriptions, and information stored in an electronic health record.
The statute covers personal information linked or reasonably linkable to a consumer that identifies their past, present, or future physical or mental health status.
Its examples include:
- Physical and mental health conditions, diagnoses, and treatment information
- Biometric and genetic information
- Reproductive and sexual health information
- Gender-affirming care information
- Use or purchase of prescribed medications
- Precise location information that could indicate someone is seeking healthcare services
- Inferences about health status derived from other personal information
The final category matters particularly for businesses using marketing quizzes or personalized recommendations.
A direct-to-consumer health brand might ask visitors about weight-management goals, symptoms, medications, or treatment preferences before allowing them to register as patients. Those responses may qualify as consumer health data even if no clinician has reviewed them.
Similarly, a supplement quiz could fall within the law when it collects identifiable information about symptoms, health concerns, or inferred conditions. A generic product preference does not necessarily qualify, but the context and the conclusions drawn from the information matter.
Washington's Attorney General explains that consumer health data may also include health-related inferences drawn from information that was not originally collected as medical data.
If no: Information that does not identify or reasonably reveal a consumer's health status may fall outside this particular definition. For example, ordinary product browsing does not automatically become consumer health data simply because the business sells wellness products.
Once the information qualifies as consumer health data, the next issue is whether a statutory exemption applies.
Is It Already PHI Under HIPAA?
If yes: When the information meets HIPAA's definition of protected health information (PHI), Washington's My Health My Data Act expressly excludes that information from its coverage.
This exemption matters for healthcare providers and their business associates because it prevents the same HIPAA-protected information from automatically falling under both frameworks.
The Act's exemptions section extends beyond PHI alone. It also exempts health care information handled under Washington's health care information law (chapter 70.02 RCW) and information de-identified to HIPAA standards. Information that originates from exempt health information and is intermingled with it so the two cannot be distinguished is exempt as well, when a HIPAA covered entity or business associate, or a Washington health care provider or facility, maintains it.
However, the exemption applies only to information that meets the relevant definition, not automatically to every activity a healthcare company conducts.
A business can process HIPAA-protected patient records while also collecting separate consumer health data through marketing websites, advertising tools, or pre-intake experiences.
Bask Health's HIPAA-compliant platform supports protected clinical workflows, and patient information handled as PHI within that environment can fall under the statutory HIPAA exemption. Information a brand collects separately through marketing websites, advertising pixels, or questionnaires before clinical intake may fall outside that exemption, making it important to map those data flows independently.
If no: When the information is not PHI and no other exemption applies, it may be covered by Washington's consumer health privacy requirements.
The distinction between PII and PHI is therefore more than a terminology issue. An email address connected to a health-related questionnaire may raise different legal questions depending on the organization collecting it, the purpose of collection, and how the information is processed.
Before relying on the HIPAA exemption, a brand should identify which systems and business activities actually handle PHI and which collect other types of consumer health information.
Does Being a Small Business Get You Out?
Qualifying as a small business does not exempt an organization from Washington's My Health My Data Act.
The statute defines a small business as a regulated entity meeting either of these conditions:
- It collects, processes, sells, or shares consumer health data involving fewer than 100,000 consumers during a calendar year.
- It derives less than 50% of gross revenue from collecting, processing, selling, or sharing consumer health data and handles consumer health data involving fewer than 25,000 consumers.
The second condition's revenue threshold cannot be considered independently of the 25,000-consumer threshold.
Small-business classification originally affected when certain provisions became enforceable. Most covered regulated entities had to comply beginning March 31, 2024, while qualifying small businesses received until June 30, 2024.
Both dates have passed.
A startup collecting consumer health information from a relatively small audience therefore cannot assume that its size removes its obligations.
If you are not a small business, the conclusion is the same. Larger covered organizations have been subject to the law since March 31, 2024.
Either way, the next question concerns how the organization obtains permission to collect and share information.
Do You Have Consent for Collecting and for Sharing?
If yes: When your business collects consumer health data with valid consent for a specified purpose, it may satisfy the law's collection-consent requirement for that activity.
The statute also permits collection without that consent to the extent necessary to provide a product or service the consumer requested.
These are distinct legal bases, and a brand should identify which applies to each collection activity rather than treating every interaction as though it were automatically necessary to deliver a service.
Sharing consumer health data creates an additional requirement. In general, the law requires consent separate from collection consent, unless sharing is necessary to provide the requested product or service.
That means permission to collect information through a questionnaire does not automatically authorize sharing it with advertising partners or other third parties.
Consent must be obtained before the relevant collection or sharing. The law also requires a clear, affirmative, informed agreement rather than relying on passive behavior as consent.
The Washington Attorney General's guidance further explains that selling consumer health data requires valid authorization, and both the seller and purchaser must retain it for six years.
Consumers also have rights to access certain information about their data, withdraw consent, and request deletion, subject to statutory requirements and exceptions. A business must respond to these requests within 45 days, may extend that once by another 45 days when reasonably necessary, and must offer a way to appeal a refusal. A deletion request also requires notifying the processors and third parties that received the data.
If no: When your organization collects or shares consumer health data without the necessary consent or another applicable legal basis, the relevant workflow may need to change.
For a digital health brand, that could mean reviewing quiz submissions, email marketing integrations, analytics tools, and the information transferred to outside platforms.
The key distinction is between data processing needed to deliver a requested service and additional uses that require separate permission.
Do You Advertise Near Clinics?
If yes: When your business uses location-based advertising near healthcare facilities, Washington's geofencing restrictions may apply.
The Act prohibits implementing a geofence around an entity that provides in-person healthcare services when the geofence is used to:
- Identify or track consumers seeking healthcare services
- Collect consumer health data from those consumers
- Send notifications, messages, or advertisements to those consumers
For purposes of the law, a geofence is a virtual boundary extending 2,000 feet or less from the perimeter of a physical location.
The restrictions address certain uses of location-based technology rather than prohibiting every form of location-targeted advertising. The important questions are where the boundary is placed and whether it is used for one of the prohibited purposes involving people seeking healthcare.
A telehealth brand using advertising platforms should examine any location-based campaigns targeting areas surrounding clinics, pharmacies, or other locations that provide in-person healthcare services.
If no: When your organization does not use geofencing for these prohibited purposes, this particular restriction may not affect its advertising activities.
However, not using geofencing does not remove obligations governing the collection, sharing, and sale of consumer health data.
The first class action under the Act, Maxwell v. Amazon.com, filed in federal court in Washington in February 2025, did not involve a geofence. Its complaint alleged that an advertising SDK built into third-party apps collected precise location data that could reveal visits to healthcare facilities, without the consent and disclosures the Act requires.
Washington also makes Act violations actionable under its Consumer Protection Act, with enforcement available through the Attorney General and private civil lawsuits. Because the legal scope depends on the facts, brands should confirm their obligations with qualified counsel rather than assume an existing privacy program covers every requirement.
What to Put on Your Homepage
A covered regulated entity or small business must maintain a consumer health data privacy policy and prominently publish a link to it on its homepage.
This is a specific requirement under RCW 19.373.020. The Attorney General's guidance clarifies that the consumer health data privacy policy should have its own distinct homepage link rather than being buried within an unrelated general privacy policy.
The policy must clearly disclose:
- The categories of consumer health data collected and the purposes for collecting and using that information
- The categories of sources from which the information is collected
- The categories of consumer health data shared
- The categories of third parties and affiliates receiving the information
- How consumers can exercise their rights under the Act
The policy must also comply with statutory requirements for disclosing changes and identifying additional uses or sharing that require appropriate consent.
For a covered health brand, this means the homepage should provide a prominent route to a dedicated consumer health data privacy policy that accurately reflects the company's collection, sharing, and processing practices.
FAQs
Can Consumers Sue Under the My Health My Data Act?
Yes. Violations of Washington's My Health My Data Act are treated as violations of the state's Consumer Protection Act.
The Attorney General can enforce the law, and consumers may also bring private civil actions under that framework, subject to applicable legal requirements.
Does the Law Apply to Companies Outside Washington?
It can. A company outside Washington may still fall under the law if it does business in the state, provides products or services targeted to Washington consumers, and meets the definition of a regulated entity.
Certain processor obligations may also apply independently. The first question, therefore, is whether the company's activities involve Washington consumers and consumer health data, not simply where the company is incorporated.
If We Are HIPAA Compliant, Are We Covered?
HIPAA compliance does not automatically establish compliance with Washington's My Health My Data Act.
The law expressly exempts information qualifying as HIPAA-protected PHI, but a healthcare company may collect other consumer health data through marketing, websites, questionnaires, and advertising systems.
Evaluate those activities separately to determine whether Washington's requirements apply.
What Are the Penalties Under Washington's My Health My Data Act?
Washington enforces violations through its Consumer Protection Act. The Attorney General can seek injunctions and civil penalties of up to $7,500 per violation.
Consumers who show an injury to their business or property can sue for actual damages and attorney's fees. A court may increase damages up to three times the actual amount, capped at $25,000.
References
- Washington State Legislature. (n.d.). Chapter 19.373 RCW: Washington My Health My Data Act. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373&full=true
- Washington State Office of the Attorney General. (n.d.). Protecting Washingtonians' personal health data and privacy. https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy
- Washington State Legislature. (2023). RCW 19.373.100: Exemptions. https://lawfilesext.leg.wa.gov/Law/RCWArchive/2023/htm/RCW%20%2019%20%20TITLE/RCW%20%2019%20.373%20%20CHAPTER/RCW%20%2019%20.373%20.100.htm
