The Washington My Health My Data Act, chapter 19.373 RCW, sets duties for any regulated entity or small business that collects, shares or sells consumer health data of Washington consumers, with exemptions for information such as HIPAA protected health information. Integral Healthcare Solutions (IHS) drafts the data inventory, consent map, consumer health data privacy policy and request procedures for your counsel to approve. Your counsel confirms whether the Act applies; IHS is a consulting firm, not a law firm, and this page is not legal advice.
Last updated: November 2026
What does the Washington My Health My Data Act require?
The Act requires a regulated entity or small business to publish a consumer health data privacy policy, get consent to collect and to share, honor access, deletion and appeal rights, and meet processor, sale and geofence rules. We read the full chapter on the Washington Legislature's site; page opened November 6, 2026: https://app.leg.wa.gov/RCW/default.aspx?cite=19.373. In the table, entity means a regulated entity or small business. The policy, consent, consumer-rights, security, processor and sale duties began March 31, 2024 for a regulated entity and June 30, 2024 for a small business.
| Section | What it asks | What answers it |
|---|---|---|
| 19.373.010(8) | Consumer health data is personal information linked or reasonably linkable to a consumer that identifies the consumer's past, present or future physical or mental health status. Health status includes, but is not limited to, treatment, use or purchase of prescribed medication, biometric data, genetic data and precise location information that could reasonably indicate an attempt to acquire or receive health services or supplies. It also includes information derived or extrapolated from nonhealth information, including by algorithms, that an entity or its processor processes to associate or identify a consumer with that data. Subsection (8)(c) excludes personal information used in qualifying research governed by an institutional review board or similar body. | Data inventory |
| 19.373.020(1) | An entity maintains a consumer health data privacy policy that clearly and conspicuously discloses the categories collected and the purpose, the categories of sources, the categories shared, the categories of third parties and specific affiliates receiving them, and how a consumer exercises the rights in RCW 19.373.040, and prominently publishes a link to it on its homepage. It may not collect, use or share additional categories or purposes the policy does not disclose without first disclosing them and obtaining the consumer's affirmative consent before doing so. | Policy, homepage link and change control |
| 19.373.030(1) and 19.373.010(6) | An entity may not collect consumer health data except with consent for the collection for a specified purpose, or to the extent necessary to provide a product or service the consumer requested. It may not share it except with consent for the sharing that is separate and distinct from the consent to collect, or to the extent necessary to provide a product or service the consumer requested. Consent comes first, requested with clear and conspicuous disclosures. It may not be obtained through acceptance of a general or broad terms of use agreement or similar document that describes personal data processing along with other unrelated information, by hovering over, muting, pausing or closing content, or through deceptive designs. | Consent flows and screens |
| 19.373.040(1)(a) to (c) | A consumer may confirm whether an entity is collecting, sharing or selling the data and access it, withdraw consent, and have the data deleted. Deletion reaches all parts of the entity's network, including archived or backup systems, and the entity notifies affiliates, processors, contractors and other third parties that received the data. For data on archived or backup systems, the deletion may be delayed to enable restoration of those systems, and the delay may not exceed six months from authenticating the deletion request. | Request and deletion procedure |
| 19.373.040(1)(g) and (h) | The entity complies with requests to confirm and access, withdraw consent or delete without undue delay and in all cases within 45 days of receipt, unless it cannot authenticate the request using commercially reasonable efforts, in which case it need not comply and may ask for the additional information reasonably necessary to authenticate; one 45-day extension is allowed when reasonably necessary if the consumer is told of it and the reason within the first 45 days. The entity also provides a conspicuously available appeal process for a refusal, answers an appeal in writing within 45 days, and with a denial gives the consumer a way to contact the attorney general to submit a complaint. | Request clock and appeal step |
| 19.373.060 | A processor may process consumer health data only under a binding contract that sets forth the processing instructions and limits its actions. One that acts outside the contract is considered a regulated entity or small business for that data. | Processor contract checklist |
| 19.373.070 and 19.373.080 | It is unlawful for any person to sell or offer to sell consumer health data without first obtaining valid authorization from the consumer, separate and distinct from the consent to collect or share. It is also unlawful to implement a geofence (a virtual boundary 2,000 feet or less from the perimeter of the location) around an entity that provides in-person health care services where it is used to identify or track consumers seeking health care services, collect consumer health data from them, or send them notifications, messages or advertisements related to their consumer health data or health care services. | Sale and location-technology review |
Who needs a compliance program and what triggers it?
In IHS's reading, a regulated entity or small business that handles consumer health data of a Washington consumer needs one. Under RCW 19.373.010(23), a regulated entity is a legal entity that conducts business in Washington, or produces or provides products or services targeted to consumers in Washington, and that alone or jointly with others determines the purpose and means of collecting, processing, sharing or selling consumer health data. Government agencies, tribal nations and contracted service providers processing data for a government agency are not regulated entities. A small business, under RCW 19.373.010(28), is a regulated entity that meets one or both of two thresholds: it collects, processes, sells or shares the data of fewer than 100,000 consumers during a calendar year; or it derives less than 50 percent of gross revenue from those activities and controls, processes, sells or shares the data of fewer than 25,000 consumers.
RCW 19.373.100(1)(a) exempts information that meets the definition of, among others, protected health information for purposes of HIPAA and related regulations, health care information collected, used or disclosed in accordance with chapter 70.02 RCW, and patient identifying information collected, used or disclosed in accordance with 42 CFR Part 2. Paragraph (1)(b) adds information originating from, and intermingled to be indistinguishable with, that information when a HIPAA covered entity or business associate, or another holder the paragraph lists, maintains it. The section has further exemptions.
Triggers include having no policy, consent flow, deletion procedure or appeal process, or adding a data category, purpose, processor, sale or location-based advertising.
How IHS helps
IHS runs five steps: a gap assessment against the sections above; a map of the consumer health data you collect, why, and who receives it; drafting of the data inventory, consent-flow map, privacy policy, request-handling procedure with deletion and appeal, and processor contract checklist; a mock review of the finished file; and readiness support. You supply product and data facts, counsel's confirmation of applicability, the website and app changes, and any notices.
The real limit: IHS builds documents and maps, gives no legal advice and does not communicate with any regulator for you.
IHS was founded in 2002 and is led by Thomas G. Goddard, JD, PhD, former Chief Operating Officer and General Counsel of URAC.
What to have ready
- The health-related data you collect from consumers and where (RCW 19.373.010(8)).
- Your current privacy policy and where its link appears (RCW 19.373.020(1)).
- How and when you ask for consent to collect and to share (RCW 19.373.030(1)).
- Your deletion process, backup copies, request log, response times and appeal path (RCW 19.373.040(1)).
- Contracts with processors (RCW 19.373.060).
- Any sale of the data, and any geofence or location-based advertising (RCW 19.373.070 and 19.373.080).
- Your analysis with counsel of which data is protected health information or otherwise exempt (RCW 19.373.100).
The introductory call is free; bring what you already have.
How it compares
In RCW 19.373.005(2) the legislature found that HIPAA only covers health data collected by specific health care entities and that data collected by noncovered entities, including certain apps and websites, lacks the same protections. For the HIPAA side see HIPAA Privacy Rule compliance program; for the Federal Trade Commission rule, health breach notification; for substance use disorder records, Part 2 compliance; more in compliance services.
How is the Act enforced?
RCW 19.373.090 says a violation of the chapter is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW. That act lets the attorney general bring an action to restrain acts declared unlawful (RCW 19.86.080(1)) and lets a person injured in business or property by a violation of RCW 19.86.020 (or four other listed sections) bring a civil action (RCW 19.86.090). How they apply here is a question for counsel. The consumer protection act also has a civil penalties section, RCW 19.86.140, which counsel should read (pages opened November 6, 2026).
What does a Washington My Health My Data Act program cost?
Government fees: the chapter sets no fee for adopting a program. Consulting fees: IHS does not publish a price for this work and scopes each engagement after a free introductory call.
What this is not
- It is not legal advice or a finding that the Act applies to you.
- It is not a website or app build.
- It is not a guarantee of how any regulator or court will view your program.
Frequently asked questions
What is consumer health data under the Act?
Personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present or future physical or mental health status (RCW 19.373.010(8)(a)).
Who is a consumer under the Act?
A natural person who is a Washington resident, or whose consumer health data is collected in Washington. The term covers a person acting only in an individual or household context and excludes an individual acting in an employment context (RCW 19.373.010(7)).
Do we need a separate privacy policy?
The Act names a consumer health data privacy policy that must disclose five listed items and be linked from the homepage (RCW 19.373.020(1)(a) and (b)). It does not say in terms whether that must be a separate document; counsel decides the form.
Is consent to share different from consent to collect?
Yes. RCW 19.373.030(1)(b)(i) requires consent for sharing that is separate and distinct from the consent to collect, unless the sharing is to the extent necessary to provide a product or service the consumer requested.
How long do we have to delete data from backups?
RCW 19.373.040(1)(c)(iii) allows deletion from archived or backup systems to be delayed to enable restoration of those systems; the delay may not exceed six months from authenticating the deletion request.
Do consumers get an appeal?
Yes. RCW 19.373.040(1)(h) requires an appeal process. The entity answers in writing within 45 days of receiving the appeal and, if it denies it, gives the consumer a way to contact the attorney general to submit a complaint.
Does the Act apply if we are covered by HIPAA?
The Act does not apply to information that meets the definition of protected health information under HIPAA and related regulations (RCW 19.373.100(1)(a)(i)). Paragraph (1)(b) also exempts information originating from and intermingled to be indistinguishable with it when a covered entity, business associate or other listed holder maintains it. Counsel decides which data falls where.
Who confirms the Act applies to us?
Your counsel. IHS gives no legal advice and does not communicate with any regulator for you.