Washington's My Health My Data Act, signed by Governor Jay Inslee on April 27, 2023, takes effect March 31, 2024 for large businesses and June 30, 2024 for small businesses. Regulated entities must publish a separate Consumer Health Data Privacy Notice, capture opt-in consent for any data collection or sharing beyond what is strictly necessary to deliver a service, and respond to consumer requests to access, correct or delete health data. The law also prohibits geofencing around health service facilities.
What the notice actually has to say
The notice must list categories of consumer health data collected, purposes for collection, sources, third parties receiving the data, and how consumers can exercise their rights. It must be linked prominently on the home page and live separately from the main privacy notice.
The deletion right is sweeping. TrustArc counsel Andrew Scott noted that deletion obligations are comprehensive, extending to backup systems and third-party repositories. A six-month extension is permitted only for backup deletion, starting from when the request is verified.
Our analysis
Washington's law treats health data as a category separate from general personal data—and it does so without adopting HIPAA's narrow definition. A fitness app, a period tracker, a marketing site that asks about allergies: all in scope, regardless of whether they touch a covered entity.
Who benefits: privacy lawyers, consent management platforms, and consumers who want a clear say over their data. Who loses: any business that added a vague privacy statement and never built the infrastructure to back it up.
The deletion mandate creates genuine operational tension. Backups exist so organizations can recover from incidents. Enforcing deletion across backup systems creates forensic and legal exposure. Expect contracts and SLAs to be renegotiated so vendors can comply without breaking their own disaster recovery posture.
Watch for: similar legislation in other states, and for the Washington Attorney General to bring an early case that tests enforcement scope.
Worked example: a retailer with a wellness quiz
Say you run an online store and added a wellness quiz to your email capture flow. The quiz collects answers about sleep, diet and skin conditions. Under My Health My Data, that is consumer health data. You need a separate notice, an opt-in for any sharing beyond order fulfillment, a deletion pathway that includes your marketing automation vendor and your backup snapshots, and a clear opt-out mechanism. The simplest path is to stop collecting data you cannot honor the deletion right for.
Bottom line
My Health My Data is a compliance burden, but it is also a forcing function to clean up data practices that should not have existed in the first place. Treat the March 2024 deadline as a hard line.
Key takeaways
- Regulated entities must publish a separate Consumer Health Data Privacy Notice listing categories, purposes, sources, third parties, and consumer rights.
- Separate opt-in consent is required before collecting or sharing consumer health data for purposes beyond delivering a requested service.
- Deletion requests must be honored comprehensively, including from backups and third parties, with a maximum six-month delay for backup systems.
- Using geofencing around health service facilities to identify, track, or message consumers is prohibited.
Frequently asked questions
When does the law take effect?
March 31, 2024 for large businesses and June 30, 2024 for small businesses.
Who signed it?
Washington Governor Jay Inslee signed House Bill 1155 on April 27, 2023.
What is the new notice requirement?
A separate Consumer Health Data Privacy Notice, prominently linked from the home page, listing data categories, purposes, sources, third parties, and how consumers can exercise their rights.
Can organizations delay deletion in backups?
Only for backups, and the delay cannot exceed six months from verification of the request.
What about geofencing?
Using a geofence around a facility that provides health services to identify, track, or send messages to consumers is prohibited.
Source: trustarc.com