Washington's My Health My Data Act, Explained Like You're My Neighbor

Most people think HIPAA protects their health information everywhere. It doesn't. And that misunderstanding is one of the biggest privacy gaps in America.

HIPAA covers your doctor, your hospital, your insurer and the companies that work for them. It does not cover the period-tracking app on your phone, the fitness band on your wrist, the meditation app, the online pharmacy coupon site, or the search engine where you typed your symptoms at 2 a.m.

Washington noticed that gap and passed a law to close it. It's called the My Health My Data Act, and most Washingtonians have never heard of it. Let's fix that.

What counts as "consumer health data"

The law's definition is broad on purpose. Under RCW 19.373.010, consumer health data is personal information linked or reasonably linkable to you that identifies your past, present or future physical or mental health. That includes:

• Health conditions, treatments, diagnoses and procedures
• Medications you use or buy
• Bodily functions, vital signs, symptoms and measurements (hello, smartwatch)
• Reproductive or sexual health information
• Gender-affirming care information
• Biometric and genetic data
• Precise location that could indicate you were trying to get health services or supplies
• Data that identifies you as seeking health care

And then the clause that made data scientists across the state sit up straight: it also covers information "derived or extrapolated from nonhealth information," including "inferred" data generated "by any means, including algorithms or machine learning."

In plain words: if a company uses your grocery purchases, your browsing, or your location history to predict that you're pregnant, depressed or diabetic, that prediction is consumer health data. The inference itself is protected.

That's a big deal technically. A lot of modern ad targeting runs on exactly those kinds of inferences.

Your rights under the law

Under RCW 19.373.040, you can:

Confirm and access. Ask whether a company is collecting, sharing or selling your health data, get a copy, and get a list of every third party and affiliate it shared or sold your data to, with contact info.

Withdraw consent. Tell them to stop collecting and sharing.

Delete. Ask them to delete your health data, including from backups. They must also tell everyone they shared it with to delete it. (Backups can lag, but no more than six months.)

Get a timely answer. They have 45 days to respond, extendable once by another 45 if they tell you why. It's free up to twice a year.

Appeal. If they say no, they must have an appeal process, and if they deny your appeal, they must tell you how to complain to the Attorney General.

They also can't make you create a new account just to make a request.

Consent has real teeth

This is where the law gets stricter than most privacy laws in the country. Under RCW 19.373.030:

• A company can collect your health data only with your consent for a specific purpose, or when it's necessary to provide the service you asked for.
• Sharing needs separate consent from collecting. One checkbox can't cover both.
• Consent must come before collection, and must explain what data, why, who it's shared with, and how to withdraw.
• Consent can't be buried in a general terms-of-use agreement, and it can't be "obtained" by you hovering, closing a pop-up, or through deceptive design.

Selling your health data requires even more: a signed, plain-language authorization that names the buyer, explains the purpose, expires after one year, and makes clear you can't be denied service for refusing (RCW 19.373.070).

The 2,000-foot geofence ban

This is my favorite provision, because it's so specific.

A geofence is a virtual boundary drawn around a real place using GPS, cell towers, Wi-Fi or similar signals. Advertisers use them to detect when your phone enters an area, and then target you.

Under RCW 19.373.080, it's illegal to set up a geofence of 2,000 feet or less around a place that provides in-person health care, when it's used to identify or track people seeking care, collect their health data, or send them health-related ads or messages.

Think about why that exists. Someone walks into a clinic, and an hour later their phone starts showing ads based on that visit. Or worse, their visit ends up in a dataset sold to someone who wants to know who went there. Washington said no.

Has anyone used it?

Yes. In February 2025, a Lake Stevens resident filed the first class action under the law against Amazon, alleging that Amazon's advertising software, embedded in other companies' apps, collected location data without proper consent. Amazon denied the allegations and said its agreements prohibit publishers from sending it consumer health data, according to Washington State Standard. The case is still a test of how far the law reaches.

Attorney General Nick Brown has said his office has been "thoughtful about enforcement because the law is still relatively new," focusing on educating organizations first, and that "we may see more cases" as the law matures (IAPP). Violations are treated as unfair or deceptive practices under the state Consumer Protection Act, which also lets individuals sue.

How to use your rights this week

1. Pick one app. Your fitness tracker, period tracker, pharmacy app, or meditation app.
2. Find its "Consumer Health Data Privacy Policy." Covered companies must link to it from their homepage. If you can't find one from a company that clearly handles health data, that's worth noting.
3. Send a request. Use their stated method. Something simple works: "Under Washington's My Health My Data Act, RCW 19.373.040, I request confirmation of whether you collect, share or sell my consumer health data, a copy of that data, and a list of all third parties and affiliates with whom it has been shared or sold."
4. Mark your calendar for 45 days.
5. If they ignore you, you can file a complaint with the Washington Attorney General.

For small businesses: yes, this might be you

Here's what surprises business owners: this law isn't only for big tech. It can apply to gyms, spas, salons, wellness coaches, supplement shops, yoga studios, fitness apps, and any website that collects health-related information from Washington consumers.

The law has a "small business" category, for businesses handling health data of fewer than 100,000 consumers a year, or those that make less than half their revenue from health data and handle fewer than 25,000 consumers. But small businesses still had to comply, starting June 30, 2024. Smaller doesn't mean exempt.

My practical starter checklist:

• Map it. Write down every place you collect anything health-related: intake forms, booking notes, online quizzes, wearables integrations.
• Check your tracking pixels. If you run ads, the pixels on your website may send visitor data to ad platforms. On pages about health services, that can be a problem. Talk to whoever manages your site.
• Write the policy. Post a clear consumer health data privacy policy linked from your homepage.
• Separate your consents. One for collecting, one for sharing. No pre-checked boxes.
• Collect less. The safest health data is the data you never collected.

I'm not a lawyer, and this isn't legal advice. If you handle a lot of health data, talk to one. But don't let that stop you from doing the basics today.

Pour me another: Did you know about this law before today? Tell me through the contact form. I want to know how far the word has spread.

Sip slow, stay curious.D