Washington My Health My Data Act: What It Covers

A state law aimed at health information that the federal HIPAA rules do not reach.

By Siddharth ShankarUpdated October 24, 2026

Much of the health information that people share online is not held by doctors or insurers. It sits in apps, retailers and websites. Washington State passed a law to cover some of that gap. This guide follows the Washington Attorney General’s page on protecting personal health data. The page is a summary, so for exact legal wording, read the statute itself.

What it is for

HIPAA applies to certain health care providers, plans and their partners. Many consumer services fall outside it. The My Health My Data Act applies to consumer health data held by regulated entities, and it is a Washington state law.

What counts as consumer health data

According to the Attorney General’s page, consumer health data is data that identifies a consumer’s past, present or future physical or mental health status. The page gives examples:

• the use and purchase of prescribed medication;
• non-prescription purchases such as toiletries, but only if the entity infers a consumer’s health status from them;
• health information inferred from non-health data, such as a retailer’s “pregnancy prediction score” based on purchases;
• data from an app that tracks bodily functions such as digestion or perspiration.

Data that does not identify health status falls outside the definition.

Who has to follow it

The page describes regulated entities as businesses that operate in Washington or offer products or services targeted to Washington consumers, and that determine, alone or with others, why and how consumer health data is collected, processed, shared or sold. Processors that handle data for a regulated entity are covered, including out-of-state ones. An entity that only stores data in Washington is not a regulated entity. Some exceptions apply.

Key dates

• Section 10 applies to all persons from July 23, 2023.
• Regulated entities that are not small businesses had to comply with sections 4 to 9 from March 31, 2024.
• Small businesses had to comply with sections 4 to 9 from June 30, 2024.

Consent for selling and the right to delete

The page says it is unlawful for anyone to sell or offer to sell consumer health data without the consumer’s valid authorisation. Sellers and purchasers must keep a copy of each valid authorisation for six years. Consumers can have their consumer health data deleted from regulated entities’ networks, including archived and backup systems. Regulated entities and small businesses must prominently publish a link to their consumer health data privacy policy on their homepage, and the link must be separate from other links.

The Attorney General’s page does not describe rights of access or withdrawal of consent, so this guide does not either. Check the statute for those points.

Enforcement

Under section 11, any violation is a per se violation of the Washington Consumer Protection Act. The Attorney General enforces the Act, and it can also be enforced through private lawsuits.

Why this matters

Cases like the Flo Health case, the BetterHelp case and the GoodRx case show how consumer health data can be shared for advertising. The Washington law is one response at state level.

What you can do

1. Look for the consumer health data privacy policy link on a business’s homepage.
2. Check what you are asked to authorise. Selling health data requires your valid authorisation.
3. Ask for deletion if you no longer want a business to hold your health data.
4. Keep records of requests and replies.
5. Be careful with inferred data. A shopping basket or app can reveal more about your health than a form does.
6. Use other rights too. If you want your medical records, see the HIPAA right of access. General privacy laws in other states, such as Oregon and Virginia, give broader rights.