Washington (United States)

LawStatus not verifiedSupplied RCW chapter certified 15 August 2025· Washington Attorney General; courts under the Consumer Protection Act

RCW Chapter 19.373

Washington My Health My Data Act

Prepared by Shubhank Suman · Last reviewed 18 October 2026

Document page

Status not verified beyond supplied text

Legal character: State statute
Region: North America

What it covers

Protects reasonably linkable consumer health information, including mental and physical health, reproductive care, biometrics, genetics, health-indicative location and health information inferred from other data using algorithms or machine learning. It regulates privacy disclosures, collection and sharing, consumer requests, security, processors, sales and certain health-facility geofences.

Why it matters

Addresses health-data privacy outside the information protected by HIPAA and other listed regimes. Small businesses are covered; information-level exemptions must not be mistaken for blanket exemptions for every record held by a health-care organisation.

Refer to it when

Research health apps, health-related advertising, inferred health profiles, consumer health-data sales or location tracking involving Washington residents or data collected in Washington.

AI, privacy and cybersecurity relevance

AI: High
Privacy: Very High
Cyber: High

HIGH RELEVANCE

Expressly includes health data derived by algorithms and machine learning; this is a health-data law, not a general AI framework.

Privacy

VERY HIGH RELEVANCE

Consent, health-data rights, sale authorisation and geofencing restrictions.

Cybersecurity

HIGH RELEVANCE

Access limits, security practices and processor controls.

Applicability

Washington residents and individuals whose consumer health data is collected in Washington, subject to the consumer, regulated-entity and small-business definitions and RCW 19.373.100 exclusions.

Read first

RCW 19.373.010 → .100 (exemptions) → .020-.040 → .050-.080 → .090.

Provisions / sections covered

RCW 19.373.010 - Definitions and scope

Consumer health data includes algorithmic inferences. Consumers act in an individual or household context, not employment. Regulated entities target or conduct business in Washington; government and other definition-level exclusions apply.

RCW 19.373.020-.040 - Policy, consent and rights

Requires health-data privacy disclosures, separate collection/sharing consent unless the requested-service necessity exception applies, and access, withdrawal, deletion and appeal mechanisms.

RCW 19.373.050-.060 - Security and processors

Restricts employee/processor access and requires appropriate administrative, technical and physical security; processing is governed by instructions and a binding contract.

RCW 19.373.070-.080 - Sales and geofencing

Sales require a distinct signed authorisation. The geofence prohibition concerns specified identification, tracking, collection and health-related messaging purposes around in-person health-care services, not every use of geographic boundaries.

RCW 19.373.090-.100 - Enforcement and exemptions

Incorporates the Consumer Protection Act. Check the enumerated health, research and other information exemptions, including information governed by GLBA and FERPA.

Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.

Related instruments in this library

Document page in the Knowledge Base - full text or PDF where it is available for this record.

This library locates primary and official sources. It does not interpret the law and it is not legal advice.