Washington’s My Health My Data Act (chapter 19.373 RCW) regulates health data that falls outside HIPAA, and some practice marketing data can fall into that gap: website visitors, ad audiences and inquiry forms from people who are not yet patients. This guide is for practice owners and marketing teams with patients or prospects in Washington. It explains the main rules in plain words, quotes the statute, and lists questions to take to counsel.
- SearchAn adult looks for care near them.
- Your pageWhat you treat, who sees them, one way to book.
- Call or formThey call or send a request.
- Front deskBooks the visit and never guesses a cause.
- Clinical teamThe clinician decides the plan.
1. What the Act covers
The Washington Attorney General describes the Act as the first privacy-focused law in the country to protect personal health data that falls outside the ambit of HIPAA (Attorney General overview). The statute defines “consumer health data” as personal information linked or reasonably linkable to a consumer that identifies their past, present or future physical or mental health status. The list of examples includes:
- individual health conditions, treatment, diseases or diagnosis;
- health-related surgeries or procedures;
- use or purchase of prescribed medication;
- precise location information that could reasonably indicate an attempt to acquire or receive health services or supplies;
- data that identifies a consumer seeking health care services.
A request for a consultation about a named treatment can carry exactly this kind of information. A “consumer” is a natural person who is a Washington resident, or whose consumer health data is collected in Washington.
2. Who must comply, and where HIPAA fits
A “regulated entity” is any legal entity that conducts business in Washington or targets products or services to consumers in Washington, and that, alone or jointly with others, determines the purpose and means of collecting, processing, sharing or selling consumer health data. A “small business” is a regulated entity under the Act’s volume or revenue thresholds; the Attorney General notes that small businesses had a later start date (June 30, 2024) than other regulated entities (March 31, 2024), but they are covered.
The Act does not apply to information that meets the definition of protected health information under HIPAA. That exemption is about the information, not the business, so two points matter for practices:
- A health care provider is a HIPAA covered entity only if it transmits health information electronically in connection with a covered transaction (45 CFR 160.103). A practice that does not do so, for example some cash-pay practices that do not bill insurance, should ask counsel whether HIPAA applies to it at all.
- Even a covered practice may hold marketing data that is not protected health information, such as data about website visitors or people who asked about a treatment but never became patients. Ask counsel how that data is classified.
3. Consent to collect, and a separate consent to share
Under RCW 19.373.030, a regulated entity or small business may not collect consumer health data except with the consumer’s consent for a specified purpose, or to the extent necessary to provide a product or service the consumer requested. Sharing needs either consent that is separate and distinct from the consent to collect, or the same necessity.
Consent must be obtained before the collection or sharing, and the request must clearly and conspicuously disclose:
- the categories of consumer health data collected or shared;
- the purpose, including the specific ways the data will be used;
- the categories of entities it is shared with;
- how the consumer can withdraw consent.
The Act’s definition of consent is strict: a clear affirmative act that is freely given, specific, informed, opt-in, voluntary and unambiguous. Acceptance of general terms of use, hovering over, muting, pausing or closing content, and agreement obtained through deceptive designs do not count.
4. A privacy policy linked from the home page
RCW 19.373.020 requires a consumer health data privacy policy that clearly and conspicuously discloses the categories of data collected and why, the categories of sources, the categories shared, the categories of third parties and specific affiliates it is shared with, and how consumers can exercise their rights. A link to it must be published prominently on the home page. Collecting or sharing a category the policy does not disclose needs that disclosure and the consumer’s affirmative consent first.
5. Rights, deadlines and enforcement
- Consumers can confirm whether their data is collected, shared or sold, access it with a list of third parties and affiliates it was shared with or sold to, withdraw consent and ask for deletion (RCW 19.373.040).
- Requests must be answered within 45 days of receipt, under the conditions in the statute.
- Selling consumer health data requires a valid, signed authorization with specific contents (RCW 19.373.070).
- A violation is treated as an unfair or deceptive act under Washington’s Consumer Protection Act, chapter 19.86 RCW (RCW 19.373.090).
6. Geofencing around a practice is off limits
RCW 19.373.080 makes it unlawful to implement a geofence around an entity that provides in-person health care services where it is used to identify or track consumers seeking health care services, collect consumer health data from them, or send them notifications, messages or advertisements related to their consumer health data or health care services. The Act’s definition covers a virtual boundary 2,000 feet or less from the perimeter of the location. Check location-based ad campaigns, including any your agency runs, against this rule.
7. Questions to take to counsel
- Which of our data is protected health information, and which could be consumer health data?
- Do our website forms, chat, booking widget, analytics and ad tags collect or share consumer health data, and on what basis?
- Does our consent language disclose the four required items, and is consent to share separate from consent to collect?
- Does our home page link to a consumer health data privacy policy?
- Do our agency’s or vendors’ contracts treat them as processors, and do any location-based campaigns come near our offices?
- How do we receive, verify and answer consumer requests within 45 days?
Our guides on new patient request forms and tracking new patient sources cover the form and tracking side.
Where MediLeadGen fits
MediLeadGen sends practices requests from people interested in cash-pay elective treatments. Each request goes to one practice only, with the person’s consent naming that practice, at a fixed price per delivered request.
See how it works for practices
Questions practices ask
Does Washington’s My Health My Data Act apply to medical practices?
It can. It covers entities that do business in Washington or target Washington consumers and handle consumer health data. It does not apply to information that is protected health information under HIPAA, so the answer depends on what data you hold. Ask counsel.
Is a treatment inquiry consumer health data?
It can be. The Act’s examples include health conditions, treatment, health-related surgeries or procedures, and data that identifies a consumer seeking health care services, when linked or reasonably linkable to a person.
Do we need separate consent to share data?
Unless the sharing is necessary to provide a product or service the consumer requested, the Act requires consent to share that is separate and distinct from the consent to collect, obtained before sharing.
Can we run geofenced ads around our clinic?
The Act makes it unlawful to use a geofence of 2,000 feet or less around an in-person health care provider to track people seeking care, collect their health data, or send them ads related to their health data or health care services.
General information for practice teams, not legal advice. This summary of chapter 19.373 RCW is simplified; read the statute and review your data practices with counsel. Last reviewed October 2026.