Washington's My Health My Data Act for Telehealth Companies

Washington's My Health My Data Act (RCW 19.373) applies to a telehealth company that does business in Washington or targets Washington consumers and handles "consumer health data" that HIPAA does not cover. That typically includes data from website visitors and app users before they become patients: quiz answers, symptom checkers, condition pages they browse, and inferences drawn from any of it. The law requires opt-in consent to collect that data beyond what is necessary for the service the consumer asked for, separate consent to share it, a signed authorization to sell it, and a published consumer health data privacy policy, and it is enforceable by private lawsuits.

This describes the statute for operators. Counsel should map it to your data flows.

Who and what does it cover?

• Regulated entity: any legal entity that conducts business in Washington or produces or provides products or services targeted to consumers in Washington, and that determines the purpose and means of processing consumer health data (RCW 19.373.010).
• Consumer: a Washington resident, or a natural person whose consumer health data is collected in Washington. A visitor from another state browsing your site from Seattle counts.
• Consumer health data: personal information linked or reasonably linkable to a consumer that identifies their past, present or future physical or mental health status. The statute lists examples including conditions, treatments, medication use, bodily functions and measurements, diagnoses and testing, biometric and genetic data, precise location that could indicate an attempt to obtain health services, data identifying a consumer seeking health care services, and information "derived or extrapolated from nonhealth information," including by algorithms or machine learning.
• Collect is defined broadly to include buying, accessing, receiving, inferring and deriving.

Where does the HIPAA exemption stop?

RCW 19.373.100 exempts information that is protected health information under HIPAA and health care information handled under Washington's Uniform Health Care Information Act (chapter 70.02 RCW). The exemption is for the information, not the company. For a telehealth practice, the patient's chart is usually exempt. The marketing site visitor who has not engaged your practice, the quiz that runs before intake, and the advertising audience built from page views are where the act applies.

What does the act require?

• A consumer health data privacy policy (RCW 19.373.020) that discloses the categories of data collected and why, sources, categories shared, the categories of third parties and specific affiliates receiving it, and how consumers exercise their rights. It must be linked from the homepage.
• Consent to collect (RCW 19.373.030), unless collection is necessary to provide a product or service the consumer requested. Consent must be obtained before collection.
• Separate consent to share, distinct from the consent to collect, again unless sharing is necessary to provide the requested service. Sharing with an ad platform is the obvious case.
• A valid signed authorization to sell (RCW 19.373.070), with specific contents including the buyer's name and the purpose, separate from any consent.
• Consumer rights (RCW 19.373.040) to confirm and access data, including a list of all third parties and affiliates it was shared with or sold to; to withdraw consent; and to have data deleted, including from processors. Responses are due within 45 days.
• Security and access limits (RCW 19.373.050) and binding contracts with processors (RCW 19.373.060).
• No geofencing around entities that provide in-person health care services to identify or track consumers seeking care, collect their data, or send them health-related ads (RCW 19.373.080).

The statute defines consent as a clear affirmative act and says it may not be obtained through acceptance of general terms of use, by hovering over, muting, pausing or closing content, or through deceptive design.

How is it enforced?

A violation is an unfair or deceptive act under Washington's Consumer Protection Act, chapter 19.86 RCW (RCW 19.373.090). That means the Attorney General can enforce it, and so can private plaintiffs under the Consumer Protection Act. Most provisions took effect March 31, 2024; small businesses, as defined in the act, had until June 30, 2024.

A compliance checklist for telehealth companies

1. Map every point where Washington consumer health data is collected outside the HIPAA-covered chart: website, quizzes, symptom checkers, email capture, ads and audiences.
2. Separate what is necessary to provide the service the consumer requested from everything else.
3. For everything else, add opt-in consent to collect and a separate opt-in to share, before collection, with the disclosures the statute lists.
4. Turn off third-party advertising tags on condition-specific and intake pages for Washington visitors, or for everyone. See tracking pixels on telehealth sites.
5. Publish the consumer health data privacy policy and link it from the homepage.
6. Build the rights workflow: access, third-party list, withdrawal, deletion through processors, 45-day clock, appeal.
7. Review processor contracts and ad platform terms.
8. Confirm no location-based ad targeting near clinics.

Are other states doing the same?

Yes. Nevada and Connecticut, among others, have enacted consumer health data provisions, and general state privacy laws increasingly treat health data as sensitive data that requires opt-in consent. Washington's private right of action is what makes it the one to design around. See our Washington page.

Consent language and website data flows are part of our Telehealth Policies & Consent Kit ($1,950). See pricing.