Washington My Health My Data Act for practices

Most practice owners think of privacy in terms of HIPAA. Washington’s My Health My Data Act is different: it is a state consumer privacy law built for health data that falls outside HIPAA, and it reaches businesses outside Washington that serve people in the state. For a practice, that matters most on the website and in advertising, where visitor data is collected before anyone becomes a patient, and for businesses such as some med spas and wellness clinics that may not be HIPAA covered entities at all.

This guide explains what the law says, in its own words where possible, and the questions a practice should take to its attorney. For how this applies to quizzes and symptom tools on a practice website, see our guide to health quizzes and symptom checkers. For Washington’s geofencing ban side by side with Nevada, Connecticut and New York, see our guide to geofencing ads near health facilities.

This is general information, not legal advice. Sources cited were checked on October 28, 2026: the text of RCW 19.373 and the Washington Attorney General’s FAQ. The Act can be enforced by the Attorney General and through private lawsuits, and how it applies depends on your facts. Do not assume your practice or your website is outside it; have a privacy attorney review your situation.

What the law is and who it reaches

The Washington Attorney General describes the Act as the first privacy-focused law in the country to protect personal health data that falls outside the ambit of HIPAA. It is codified at chapter 19.373 of the Revised Code of Washington.

The Act regulates a “regulated entity,” defined in RCW 19.373.010 as any legal entity that conducts business in Washington, or produces or provides products or services that are targeted to consumers in Washington, and that determines the purpose and means of collecting, processing, sharing or selling consumer health data. The Attorney General’s FAQ adds that processors acting for a regulated entity, including out-of-state ones, must comply, and that some sections apply to any person.

So a practice in Oregon or Idaho that advertises to Washington residents, or a telehealth service seeing patients in Washington, should not assume the law is only for Washington businesses.

What counts as consumer health data

RCW 19.373.010 defines consumer health data as personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. The definition lists examples, including individual health conditions, treatment, diseases or diagnosis; health-related surgeries or procedures; and use or purchase of prescribed medication.

The Attorney General’s FAQ says the definition also covers information derived or extrapolated from non-health data when it is used to associate or identify a consumer with a health status. For a practice website, think about what a visitor’s activity can reveal: a form submitted from a page about a specific condition, a booking request for a specific procedure, or an ad audience built from people who visited a treatment page.

Consent to collect, and separate consent to share

Under RCW 19.373.030, a regulated entity or small business may not collect consumer health data except with consent from the consumer for a specified purpose, or to the extent necessary to provide a product or service the consumer requested. It may not share consumer health data except with consent that is separate and distinct from the consent to collect, or to the extent necessary to provide what the consumer requested.

The consent must be obtained before collection or sharing, and the request must clearly and conspicuously disclose, among other things, the categories of data and the purpose. Selling consumer health data is treated more strictly still: RCW 19.373.070 requires a signed valid authorization.

For marketing, the practical question is what your website tools collect and share. Advertising pixels, session recording tools and analytics that send page-level data to third parties can be sharing. Our guide to tracking pixels on practice websites explains how these tools work.

A consumer health data privacy policy, linked from the homepage

RCW 19.373.020 requires regulated entities and small businesses to maintain a consumer health data privacy policy and to prominently publish a link to it on its homepage. The Act defines homepage broadly: the introductory page of a website and any web page where personal information is collected. The Attorney General’s FAQ says the consumer health privacy policy must be a separate and distinct link.

This is separate from a HIPAA notice of privacy practices, and separate from a general website privacy policy. See our guide to a practice website privacy policy for the general one.

Consumer rights

RCW 19.373.040 and the sections that follow give consumers rights including to confirm whether their consumer health data is being collected, shared or sold, to access it, to withdraw consent and to have it deleted. Your forms, intake tools and vendors need a way to respond.

The geofencing ban

RCW 19.373.080 makes it unlawful for any person to implement a geofence around an entity that provides in-person health care services where the geofence is used to identify or track consumers seeking health care services, collect consumer health data, or send notifications, messages or advertisements related to their consumer health data or health care services. The Act defines a geofence as a virtual boundary that is 2,000 feet or less from the perimeter of the location.

For practice marketing, this rules out a tactic some vendors offer: location-based ads aimed at people visiting a competitor’s office or a hospital. It applies to any person, not only regulated entities, and the Attorney General’s FAQ says this section has applied since July 23, 2023.

Effective dates and enforcement

According to the Attorney General’s FAQ, regulated entities that are not small businesses had to comply with the main sections beginning March 31, 2024, and small businesses beginning June 30, 2024. RCW 19.373.090 makes a violation an unfair or deceptive act under the Washington Consumer Protection Act, chapter 19.86 RCW, and the FAQ says the Act is enforced by the Attorney General as well as through private action.

Where HIPAA fits

RCW 19.373.100 says the chapter does not apply to information that meets the definition of protected health information under HIPAA, along with several other listed categories. That exemption is about the information, not the business. A HIPAA covered practice can still collect information that may not be protected health information, for example data about website visitors who never become patients, or data collected by ad and analytics vendors. Businesses that are not HIPAA covered entities do not have that exemption for their health data at all.

Because the boundary depends on what data, who collects it and how, and because private lawsuits are possible, this is a question for a privacy attorney rather than a checkbox. Nevada and Connecticut have their own consumer health data laws, with different HIPAA exemptions; see our guide to consumer health data laws beyond Washington. For general state privacy laws such as California’s, Virginia’s, Texas’s and Colorado’s, and how their HIPAA exemptions differ, see our guide to state privacy laws and the HIPAA exemption.

Questions to take to your attorney

Do we reach Washington consumers?Through location, telehealth, ads or online booking.
What do our website and ad tools collect?Map every pixel, tag, form and chat tool, and what each sends to whom.
Which of that is consumer health data?Including inferences from pages visited or services requested.
Do we have the right consents?Separate consent to collect and to share, obtained before collection, for anything not strictly necessary to provide what the person asked for.
Do we need a consumer health data privacy policy?If so, with a separate link on the homepage and every page that collects personal information.
Can we answer consumer rights requests?Including from our vendors.
Do any vendors use location targeting near health care facilities?Stop any geofencing around in-person health care locations.

How we help

We build practice websites with tracking kept off pages where people share health information, and we document which tools run where so your attorney can assess laws like this one. We do not give legal advice and do not make compliance claims. See our medical website design service, or the full list in our healthcare marketing rules guide.

Frequently asked questions

Does the My Health My Data Act apply to businesses outside Washington?

It can. RCW 19.373.010 defines a regulated entity to include businesses that produce or provide products or services targeted to consumers in Washington, and the Attorney General’s FAQ says out-of-state processors must comply. Ask a privacy attorney how it applies to you.

Is a HIPAA covered practice exempt?

The Act exempts information that meets the definition of protected health information under HIPAA, not businesses as a whole. A practice can hold other data, such as website visitor data, that may fall under the Act. Have an attorney review your data flows.

Can patients sue under the Act?

The Attorney General’s FAQ says the Act is enforced by the Attorney General as well as through private action under the Washington Consumer Protection Act.

Can we use geofenced ads near clinics or hospitals?

RCW 19.373.080 makes it unlawful to geofence an entity that provides in-person health care services, within 2,000 feet, to track people, collect their health data or send them health-related ads.

Where does the privacy policy link go?

On the homepage, which the Act defines to include any web page where personal information is collected. The Attorney General says it must be a separate and distinct link.

Washington My Health My Data Act: what it means for practice websites