My Health My Data Act

Washington's My Health My Data Act reaches far beyond HIPAA. It covers consumer health data held by any business, not only health care providers, and defines that data broadly: information that identifies a person's past, present, or future physical or mental health, including what can be inferred from searches, purchases, or precise location. Businesses need consent before collecting that data and separate consent before sharing it, and a signed authorization before selling it. Consumers have rights to access and delete, and the law bans geofencing around facilities that provide in-person health care. Obligations applied from March 31, 2024, and from June 30, 2024 for small businesses. Violations are treated as violations of Washington's Consumer Protection Act, which gives consumers a private right of action. An advertising pixel on a symptom checker or pharmacy page is the textbook exposure.