language: en · last checked: 2026-10-26

Washington My Health My Data Act — RCW chapter 19.373

The consumer-health-data statute enacted by 2023 c 191 (SHB 1155). It binds a regulated entity — any legal entity that conducts business in Washington or targets products or services to Washington consumers and determines the purpose and means of collecting, processing, sharing or selling consumer health data — with no revenue or volume threshold of any kind.

Two features make it unlike the other state privacy acts in this corpus. Its definition of consumer health data reaches any personal information linked to a consumer that identifies past, present or future physical or mental health status, and "biometric data" is named in that list; and the Act is enforced through the Consumer Protection Act, which in Washington carries a private right of action — the only such route among the non-biometric state privacy statutes here.

RCW §19.373.005. Finding—Intent—2023 c 191

Verbatim from the Revised Code of Washington as published by the Washington State Legislature; see Meta.

[ 2023 c 191 s 2.]

RCW §19.373.010. Definitions

Verbatim from the Revised Code of Washington as published by the Washington State Legislature; see Meta.

The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.

• (a) Ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a company;
• (b) Control in any manner over the election of a majority of the directors or of individuals exercising similar functions; or
• (c) The power to exercise controlling influence over the management of a company.

• (a) Imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template can be extracted; or
• (b) Keystroke patterns or rhythms and gait patterns or rhythms that contain identifying information.

• (a) "Consent" means a clear affirmative act that signifies a consumer's freely given, specific, informed, opt-in, voluntary, and unambiguous agreement, which may include written consent provided by electronic means.
• (b) "Consent" may not be obtained by:
  • (i) A consumer's acceptance of a general or broad terms of use agreement or a similar document that contains descriptions of personal data processing along with other unrelated information;
  • (ii) A consumer hovering over, muting, pausing, or closing a given piece of content; or
  • (iii) A consumer's agreement obtained through the use of deceptive designs.

• (a) "Consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.
• (b) For the purposes of this definition, physical or mental health status includes, but is not limited to:
  • (i) Individual health conditions, treatment, diseases, or diagnosis;
  • (ii) Social, psychological, behavioral, and medical interventions;
  • (iii) Health-related surgeries or procedures;
  • (iv) Use or purchase of prescribed medication;
  • (v) Bodily functions, vital signs, symptoms, or measurements of the information described in this subsection (8)(b);
  • (vi) Diagnoses or diagnostic testing, treatment, or medication;
  • (vii) Gender-affirming care information;
  • (viii) Reproductive or sexual health information;
  • (ix) Biometric data;
  • (x) Genetic data;
  • (xi) Precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies;
  • (xii) Data that identifies a consumer seeking health care services; or
  • (xiii) Any information that a regulated entity or a small business, or their respective processor, processes to associate or identify a consumer with the data described in (b)(i) through (xii) of this subsection that is derived or extrapolated from nonhealth information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning).
• (c) "Consumer health data" does not include personal information that is used to engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board, human subjects research ethics review board, or a similar independent oversight entity that determines that the regulated entity or the small business has implemented reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with reidentification.

• (a) Precise location information that could reasonably indicate a consumer's attempt to acquire or receive gender-affirming care services;
• (b) Efforts to research or obtain gender-affirming care services; or
• (c) Any gender-affirming care information that is derived, extrapolated, or inferred, including from nonhealth information, such as proxy, derivative, inferred, emergent, or algorithmic data.

• (a) Raw sequence data that result from the sequencing of a consumer's complete extracted deoxyribonucleic acid (DNA) or a portion of the extracted DNA;
• (b) Genotypic and phenotypic information that results from analyzing the raw sequence data; and
• (c) Self-reported health data that a consumer submits to a regulated entity or a small business and that is analyzed in connection with consumer's raw sequence data.

• (a) Individual health conditions, status, diseases, or diagnoses;
• (b) Social, psychological, behavioral, and medical interventions;
• (c) Health-related surgeries or procedures;
• (d) Use or purchase of medication;
• (e) Bodily functions, vital signs, symptoms, or measurements of the information described in this subsection;
• (f) Diagnoses or diagnostic testing, treatment, or medication;
• (g) Reproductive health care services; or
• (h) Gender-affirming care services.

• (a) "Personal information" means information that identifies or is reasonably capable of being associated or linked, directly or indirectly, with a particular consumer. "Personal information" includes, but is not limited to, data associated with a persistent unique identifier, such as a cookie ID, an IP address, a device identifier, or any other form of persistent unique identifier.
• (b) "Personal information" does not include publicly available information.
• (c) "Personal information" does not include deidentified data.

• (a) Precise location information that could reasonably indicate a consumer's attempt to acquire or receive reproductive or sexual health services;
• (b) Efforts to research or obtain reproductive or sexual health services; or
• (c) Any reproductive or sexual health information that is derived, extrapolated, or inferred, including from nonhealth information (such as proxy, derivative, inferred, emergent, or algorithmic data).

• (a) Individual health conditions, status, diseases, or diagnoses;
• (b) Social, psychological, behavioral, and medical interventions;
• (c) Health-related surgeries or procedures including, but not limited to, abortions;
• (d) Use or purchase of medication including, but not limited to, medications for the purposes of abortion;
• (e) Bodily functions, vital signs, symptoms, or measurements of the information described in this subsection;
• (f) Diagnoses or diagnostic testing, treatment, or medication; and
• (g) Medical or nonmedical services related to and provided in conjunction with an abortion, including but not limited to associated diagnostics, counseling, supplies, and follow-up services.

• (a) "Sell" or "sale" means the exchange of consumer health data for monetary or other valuable consideration.
• (b) "Sell" or "sale" does not include the exchange of consumer health data for monetary or other valuable consideration:
  • (i) To a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the regulated entity's or the small business's assets that complies with the requirements and obligations in this chapter; or
  • (ii) By a regulated entity or a small business to a processor when such exchange is consistent with the purpose for which the consumer health data was collected and disclosed to the consumer.

• (a) "Share" or "sharing" means to release, disclose, disseminate, divulge, make available, provide access to, license, or otherwise communicate orally, in writing, or by electronic or other means, consumer health data by a regulated entity or a small business to a third party or affiliate.
• (b) The term "share" or "sharing" does not include:
  • (i) The disclosure of consumer health data by a regulated entity or a small business to a processor when such sharing is to provide goods or services in a manner consistent with the purpose for which the consumer health data was collected and disclosed to the consumer;
  • (ii) The disclosure of consumer health data to a third party with whom the consumer has a direct relationship when: (A) The disclosure is for purposes of providing a product or service requested by the consumer; (B) the regulated entity or the small business maintains control and ownership of the data; and (C) the third party uses the consumer health data only at direction from the regulated entity or the small business and consistent with the purpose for which it was collected and consented to by the consumer; or
  • (iii) The disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the regulated entity's or the small business's assets and complies with the requirements and obligations in this chapter.

• (a) Collects, processes, sells, or shares consumer health data of fewer than 100,000 consumers during a calendar year; or
• (b) Derives less than 50 percent of gross revenue from the collection, processing, selling, or sharing of consumer health data, and controls, processes, sells, or shares consumer health data of fewer than 25,000 consumers.

[ 2023 c 191 s 3.]

RCW §19.373.020. Consumer health data privacy policy

Verbatim from the Revised Code of Washington as published by the Washington State Legislature; see Meta.

• (a) Except as provided in subsection (2) of this section, beginning March 31, 2024, a regulated entity and a small business shall maintain a consumer health data privacy policy that clearly and conspicuously discloses:
  • (i) The categories of consumer health data collected and the purpose for which the data is collected, including how the data will be used;
  • (ii) The categories of sources from which the consumer health data is collected;
  • (iii) The categories of consumer health data that is shared;
  • (iv) A list of the categories of third parties and specific affiliates with whom the regulated entity or the small business shares the consumer health data; and
  • (v) How a consumer can exercise the rights provided in RCW 19.373.040.
• (b) A regulated entity and a small business shall prominently publish a link to its consumer health data privacy policy on its homepage.
• (c) A regulated entity or a small business may not collect, use, or share additional categories of consumer health data not disclosed in the consumer health data privacy policy without first disclosing the additional categories and obtaining the consumer's affirmative consent prior to the collection, use, or sharing of such consumer health data.
• (d) A regulated entity or a small business may not collect, use, or share consumer health data for additional purposes not disclosed in the consumer health data privacy policy without first disclosing the additional purposes and obtaining the consumer's affirmative consent prior to the collection, use, or sharing of such consumer health data.
• (e) It is a violation of this chapter for a regulated entity or a small business to contract with a processor to process consumer health data in a manner that is inconsistent with the regulated entity's or the small business's consumer health data privacy policy.

[ 2023 c 191 s 4.]

RCW §19.373.030. Collection or sharing of consumer health data

Verbatim from the Revised Code of Washington as published by the Washington State Legislature; see Meta.

• (a) Except as provided in subsection (2) of this section, beginning March 31, 2024, a regulated entity or a small business may not collect any consumer health data except:
  • (i) With consent from the consumer for such collection for a specified purpose; or
  • (ii) To the extent necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity or small business.
• (b) A regulated entity or a small business may not share any consumer health data except:
  • (i) With consent from the consumer for such sharing that is separate and distinct from the consent obtained to collect consumer health data; or
  • (ii) To the extent necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity or small business.
• (c) Consent required under this section must be obtained prior to the collection or sharing, as applicable, of any consumer health data, and the request for consent must clearly and conspicuously disclose: (i) The categories of consumer health data collected or shared; (ii) the purpose of the collection or sharing of the consumer health data, including the specific ways in which it will be used; (iii) the categories of entities with whom the consumer health data is shared; and (iv) how the consumer can withdraw consent from future collection or sharing of the consumer's health data.
• (d) A regulated entity or a small business may not unlawfully discriminate against a consumer for exercising any rights included in this chapter.

[ 2023 c 191 s 5.]

RCW §19.373.040. Consumer rights and requests—Refusal—Appeal

Verbatim from the Revised Code of Washington as published by the Washington State Legislature; see Meta.

• (a) Except as provided in subsection (2) of this section, beginning March 31, 2024, a consumer has the right to confirm whether a regulated entity or a small business is collecting, sharing, or selling consumer health data concerning the consumer and to access such data, including a list of all third parties and affiliates with whom the regulated entity or the small business has shared or sold the consumer health data and an active email address or other online mechanism that the consumer may use to contact these third parties.
• (b) A consumer has the right to withdraw consent from the regulated entity's or the small business's collection and sharing of consumer health data concerning the consumer.
• (c) A consumer has the right to have consumer health data concerning the consumer deleted and may exercise that right by informing the regulated entity or the small business of the consumer's request for deletion.
  • (i) A regulated entity or a small business that receives a consumer's request to delete any consumer health data concerning the consumer shall:
    • (A) Delete the consumer health data from its records, including from all parts of the regulated entity's or the small business's network, including archived or backup systems pursuant to (c)(iii) of this subsection; and
    • (B) Notify all affiliates, processors, contractors, and other third parties with whom the regulated entity or the small business has shared consumer health data of the deletion request.
  • (ii) All affiliates, processors, contractors, and other third parties that receive notice of a consumer's deletion request shall honor the consumer's deletion request and delete the consumer health data from its records, subject to the same requirements of this chapter.
  • (iii) If consumer health data that a consumer requests to be deleted is stored on archived or backup systems, then the request for deletion may be delayed to enable restoration of the archived or backup systems and such delay may not exceed six months from authenticating the deletion request.
• (d) A consumer may exercise the rights set forth in this chapter by submitting a request, at any time, to a regulated entity or a small business. Such a request may be made by a secure and reliable means established by the regulated entity or the small business and described in its consumer health data privacy policy. The method must take into account the ways in which consumers normally interact with the regulated entity or the small business, the need for secure and reliable communication of such requests, and the ability of the regulated entity or the small business to authenticate the identity of the consumer making the request. A regulated entity or a small business may not require a consumer to create a new account in order to exercise consumer rights pursuant to this chapter but may require a consumer to use an existing account.
• (e) If a regulated entity or a small business is unable to authenticate the request using commercially reasonable efforts, the regulated entity or the small business is not required to comply with a request to initiate an action under this section and may request that the consumer provide additional information reasonably necessary to authenticate the consumer and the consumer's request.
• (f) Information provided in response to a consumer request must be provided by a regulated entity and a small business free of charge, up to twice annually per consumer. If requests from a consumer are manifestly unfounded, excessive, or repetitive, the regulated entity or the small business may charge the consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request. The regulated entity and the small business bear the burden of demonstrating the manifestly unfounded, excessive, or repetitive nature of the request.
• (g) A regulated entity and a small business shall comply with the consumer's requests under subsection (1)(a) through (c) of this section [(a) through (c) of this subsection] without undue delay, but in all cases within 45 days of receipt of the request submitted pursuant to the methods described in this section. A regulated entity and a small business must promptly take steps to authenticate a consumer request but this does not extend the regulated entity's and the small business's duty to comply with the consumer's request within 45 days of receipt of the consumer's request. The response period may be extended once by 45 additional days when reasonably necessary, taking into account the complexity and number of the consumer's requests, so long as the regulated entity or the small business informs the consumer of any such extension within the initial 45-day response period, together with the reason for the extension.
• (h) A regulated entity and a small business shall establish a process for a consumer to appeal the regulated entity's or the small business's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decision. The appeal process must be conspicuously available and similar to the process for submitting requests to initiate action pursuant to this section. Within 45 days of receipt of an appeal, a regulated entity or a small business shall inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, the regulated entity or the small business shall also provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the attorney general to submit a complaint.

[ 2023 c 191 s 6.]

RCW §19.373.050. Data security practices

Verbatim from the Revised Code of Washington as published by the Washington State Legislature; see Meta.

• (a) Restrict access to consumer health data by the employees, processors, and contractors of such regulated entity or small business to only those employees, processors, and contractors for which access is necessary to further the purposes for which the consumer provided consent or where necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity or small business; and
• (b) Establish, implement, and maintain administrative, technical, and physical data security practices that, at a minimum, satisfy reasonable standard of care within the regulated entity's or the small business's industry to protect the confidentiality, integrity, and accessibility of consumer health data appropriate to the volume and nature of the consumer health data at issue.

[ 2023 c 191 s 7.]

RCW §19.373.060. Processors

Verbatim from the Revised Code of Washington as published by the Washington State Legislature; see Meta.

• (a)
  • (i) Except as provided in subsection (2) of this section, beginning March 31, 2024, a processor may process consumer health data only pursuant to a binding contract between the processor and the regulated entity or the small business that sets forth the processing instructions and limit the actions the processor may take with respect to the consumer health data it processes on behalf of the regulated entity or the small business.
  • (ii) A processor may process consumer health data only in a manner that is consistent with the binding instructions set forth in the contract with the regulated entity or the small business.
• (b) A processor shall assist the regulated entity or the small business by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the regulated entity's and the small business's obligations under this chapter.
• (c) If a processor fails to adhere to the regulated entity's or the small business's instructions or processes consumer health data in a manner that is outside the scope of the processor's contract with the regulated entity or the small business, the processor is considered a regulated entity or a small business with regard to such data and is subject to all the requirements of this chapter with regard to such data.

[ 2023 c 191 s 8.]

RCW §19.373.070. Valid authorization to sell—Defects—Provision to consumer

Verbatim from the Revised Code of Washington as published by the Washington State Legislature; see Meta.

• (a) The specific consumer health data concerning the consumer that the person intends to sell;
• (b) The name and contact information of the person collecting and selling the consumer health data;
• (c) The name and contact information of the person purchasing the consumer health data from the seller identified in (b) of this subsection;
• (d) A description of the purpose for the sale, including how the consumer health data will be gathered and how it will be used by the purchaser identified in (c) of this subsection when sold;
• (e) A statement that the provision of goods or services may not be conditioned on the consumer signing the valid authorization;
• (f) A statement that the consumer has a right to revoke the valid authorization at any time and a description on how to submit a revocation of the valid authorization;
• (g) A statement that the consumer health data sold pursuant to the valid authorization may be subject to redisclosure by the purchaser and may no longer be protected by this section;
• (h) An expiration date for the valid authorization that expires one year from when the consumer signs the valid authorization; and
• (i) The signature of the consumer and date.

• (a) The expiration date has passed;
• (b) The authorization does not contain all the information required under this section;
• (c) The authorization has been revoked by the consumer;
• (d) The authorization has been combined with other documents to create a compound authorization; or
• (e) The provision of goods or services is conditioned on the consumer signing the authorization.

[ 2023 c 191 s 9.]

RCW §19.373.080. Geofence restrictions

Verbatim from the Revised Code of Washington as published by the Washington State Legislature; see Meta.

It is unlawful for any person to implement a geofence around an entity that provides in-person health care services where such geofence is used to: (1) Identify or track consumers seeking health care services; (2) collect consumer health data from consumers; or (3) send notifications, messages, or advertisements to consumers related to their consumer health data or health care services.

[ 2023 c 191 s 10.]

RCW §19.373.090. Application of consumer protection act

Verbatim from the Revised Code of Washington as published by the Washington State Legislature; see Meta.

The legislature finds that the practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this chapter is not reasonable in relation to the development and preservation of business, and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

[ 2023 c 191 s 11.]

RCW §19.373.100. Exemptions

Verbatim from the Revised Code of Washington as published by the Washington State Legislature; see Meta.

• (a) Information that meets the definition of:
  • (i) Protected health information for purposes of the federal health insurance portability and accountability act of 1996 and related regulations;
  • (ii) Health care information collected, used, or disclosed in accordance with chapter 70.02 RCW;
  • (iii) Patient identifying information collected, used, or disclosed in accordance with 42 C.F.R. Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2;
  • (iv) Identifiable private information for purposes of the federal policy for the protection of human subjects, 45 C.F.R. Part 46; identifiable private information that is otherwise information collected as part of human subjects research pursuant to the good clinical practice guidelines issued by the international council for harmonization; the protection of human subjects under 21 C.F.R. Parts 50 and 56; or personal data used or shared in research conducted in accordance with one or more of the requirements set forth in this subsection;
  • (v) Information and documents created specifically for, and collected and maintained by:
    • (A) A quality improvement committee for purposes of RCW 43.70.510, 70.230.080, or 70.41.200;
    • (B) A peer review committee for purposes of RCW 4.24.250;
    • (C) A quality assurance committee for purposes of RCW 74.42.640 or 18.20.390;
    • (D) A hospital, as defined in RCW 43.70.056, for reporting of health care-associated infections for purposes of RCW 43.70.056, a notification of an incident for purposes of RCW 70.56.040(5), or reports regarding adverse events for purposes of RCW 70.56.020(2)(b); or
    • (E) A manufacturer, as defined in 21 C.F.R. Sec. 820.3(o), when collected, used, or disclosed for purposes specified in chapter 70.02 RCW;
  • (vi) Information and documents created for purposes of the federal health care quality improvement act of 1986, and related regulations;
  • (vii) Patient safety work product for purposes of 42 C.F.R. Part 3, established pursuant to 42 U.S.C. Sec. 299b-21 through 299b-26;
  • (viii) Information that is (A) deidentified in accordance with the requirements for deidentification set forth in 45 C.F.R. Part 164, and (B) derived from any of the health care-related information listed in this subsection (1)(a)(viii);
• (b) Information originating from, and intermingled to be indistinguishable with, information under (a) of this subsection that is maintained by:
  • (i) A covered entity or business associate as defined by the health insurance portability and accountability act of 1996 and related regulations;
  • (ii) A health care facility or health care provider as defined in RCW 70.02.010; or
  • (iii) A program or a qualified service organization as defined by 42 C.F.R. Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2;
• (c) Information used only for public health activities and purposes as described in 45 C.F.R. Sec. 164.512 or that is part of a limited data set, as defined, and is used, disclosed, and maintained in the manner required, by 45 C.F.R. Sec. 164.514; or
• (d) Identifiable data collected, used, or disclosed in accordance with chapter 43.371 RCW or RCW 69.43.165.

[ 2023 c 191 s 12.]

RCW §19.373.900. Short title

Verbatim from the Revised Code of Washington as published by the Washington State Legislature; see Meta.

Chapter 191, Laws of 2023 may be known and cited as the Washington my health my data act.

[ 2023 c 191 s 1.]

Related

• Washington RCW 19.375 — the state's standalone biometric statute: narrower ("commercial purpose", enrolment in a database), AG-only, and expressly excluding photographs and video
• Illinois BIPA — the other biometric regime reachable by a private plaintiff
• Montana Consumer Data Privacy Act — the comparator with no private right of action
• Texas TDPSA — the comparator whose FERPA exemption is data-level, as RCW 19.373.100 makes Washington's

Sources

• RCW chapter 19.373 — section list — Internet Archive capture 2026-09-17
• RCW 19.373.005 Finding—Intent—2023 c 191 — Internet Archive capture 2026-09-05
• RCW 19.373.010 Definitions — Internet Archive capture 2026-09-17
• RCW 19.373.020 Consumer health data privacy policy — Internet Archive capture 2026-09-05
• RCW 19.373.030 Collection or sharing of consumer health data — Internet Archive capture 2026-09-05
• RCW 19.373.040 Consumer rights and requests—Refusal—Appeal — Internet Archive capture 2026-09-05
• RCW 19.373.050 Data security practices — Internet Archive capture 2026-09-05
• RCW 19.373.060 Processors — Internet Archive capture 2026-01-22
• RCW 19.373.070 Valid authorization to sell—Defects—Provision to consumer — Internet Archive capture 2026-03-17
• RCW 19.373.080 Geofence restrictions — Internet Archive capture 2026-07-13
• RCW 19.373.090 Application of consumer protection act — Internet Archive capture 2026-07-12
• RCW 19.373.100 Exemptions — Internet Archive capture 2026-01-21
• RCW 19.373.900 Short title — Internet Archive capture 2026-09-05