Washington State's My Health My Data Act, signed by Governor Jay Inslee on April 27, 2023, is set to take effect March 31, 2024 for large businesses and June 30, 2024 for small businesses. The law closes a gap that state lawmakers identified: health information held by entities that fall outside HIPAA's reach.
The short version of who is in scope: far more organizations than most people expect.
What the law actually covers
The Act defines "consumer health data" broadly and applies it to any "regulated entity" that conducts business in Washington or offers products or services to Washington consumers, and that alone or jointly determines the purpose and means of collecting such information. The thresholds for being classified as a "small business" hinge on volume: under 100,000 consumer health records per year, or under 25,000 records with less than 50% of gross revenue from that data.
Exclusions cover government agencies, tribal states and contracted service providers processing data on behalf of a government agency. Everyone else is potentially in scope.
Why this stretches far beyond HIPAA
State lawmakers explicitly described the problem they were trying to solve: federal law protects only information gathered by specific healthcare providers and their business associates. Consumer software and connected devices sit in a gray zone. The Act's wording turns it into a general consumer data privacy law with a medical focus. It specifically targets health data collected by apps and websites that fall outside HIPAA's definitions.
In practice, this covers app developers, wearable makers, fitness platforms and potentially major cloud providers if they process health-related information on behalf of Washington-facing customers.
What it means for you
For security and privacy teams, the practical effect is that health-adjacent information is now regulated even when the organization collecting it never had to think about HIPAA. That means new consent flows, new data subject rights, new breach notification timelines and new vendor contract requirements.
Litigation risk is high. The law opens a private right of action under the Washington Consumer Protection Act—unlike other state laws that mostly only let individuals sue after a breach, this one opens the door for any violation claim.
Worked example: a fitness app assessing scope
Say you operate a fitness platform with two million users, including tens of thousands in Washington. You are not a HIPAA covered entity, yet you collect heart rate, weight, workout logs and sleep patterns. Under the Act, you are a regulated entity if you determine the purpose and means of that processing. You will need to assess opt-in consent for collection and sharing, build deletion request handling, update vendor contracts and run a records retention review. Starting before the 2024 dates is much cheaper than scrambling after.
Why this matters
Washington's drafters borrowed the structural bones of the CCPA but widened who is exposed and added a private right of action. The critical asymmetry: other state laws mostly only let individuals sue after a breach; this one opens the door for any violation claim.
The net effect is a regime that treats health-adjacent data as sensitive by default. Unlike HIPAA, which has decades of settled guidance, the Act is brand new. There is no roadmap yet, only the statute, commentary and a clock. Organizations that interpret broadly are safer than organizations that interpret narrowly.
What to watch next
Watch for early enforcement actions and consumer lawsuits under the Washington Consumer Protection Act. They will set the tone. Also watch for copycat legislation in other states; California's privacy debates suggest this template will travel.
If your organization touches consumer health data and has any Washington presence, assume you are in scope and start the compliance review now. The 2024 effective dates are not negotiable.
Key takeaways
- The Washington My Health My Data Act takes effect March 31, 2024 for large businesses and June 30, 2024 for small businesses.
- The law's definitions are broad enough to pull many non-HIPAA apps and websites into regulated territory.
- A private right of action under the Washington Consumer Protection Act creates significant litigation risk beyond breach-only lawsuits.
- Organizations handling health-adjacent data should start compliance work now to avoid rushed 2024 implementations.
Frequently asked questions
When does the Washington My Health My Data Act take effect?
March 31, 2024 for large businesses and June 30, 2024 for small businesses.
What types of organizations are covered?
Any entity that conducts business in Washington or targets Washington consumers and determines the purpose and means of processing consumer health data.
Does the law apply to non-HIPAA entities?
Yes. The Act specifically targets health data collected by entities not covered by HIPAA, including certain consumer-facing apps and connected devices.
What is the small business threshold?
Under 100,000 consumer health data records per year, or under 25,000 records with less than 50% of gross revenue from such data.
Source: trustarc.com