Washington My Health My Data Act
Washington · RCW ch. 19.373
A sweeping health-data privacy law covering 'consumer health data' far beyond HIPAA — including biometric data, health inferences drawn by algorithms, and reproductive health information. Companies need consent to collect or share such data, must honor deletion requests, and cannot geofence health facilities. Consumers can sue under Washington's Consumer Protection Act.
Technical detail
Chapter 19.373 RCW (HB 1155): consent requirements for collection/sharing, valid authorization for sale, deletion rights, geofencing ban around health services, and a private right of action via the WA CPA; effective Mar. 31, 2024 (small businesses June 30, 2024).
Who is protected: Washington consumers and individuals whose health data is collected in Washington
Who must comply: Regulated entities doing business in Washington that collect consumer health data (includes AI-derived health inferences)
Key facts
| Jurisdiction | Washington |
|---|---|
| Level | State |
| Status | In effect |
| Protection strength | Limited protection |
| Effective date | 2024-03-31 |
| Enacted | 2023-04-27 |
| Citation | RCW ch. 19.373 |
| Enforced by | Washington Attorney General; courts (private CPA actions) |
| Private right of action | Yes — individuals can sue |
| Penalties | CPA remedies: actual damages (trebled up to $25,000), injunctive relief, attorney's fees; AG civil penalties |
| Topics | consumer data privacy · healthcare AI · biometric data · consumer protection · data retention |
| Last verified | 2026-06-10 |
| Official source | Revised Code of Washington, Chapter 19.373 RCW: My Health My Data Act ↗ |
More AI rules in Washington
- WA SB 5982 (Data Center / Clean Energy) · In effect
- Washington HB 2225 (AI chatbot disclosure, minor protections, crisis protocols) · Enacted (not yet in effect)
- Washington HB 1170 (AI content watermarking & provenance metadata) · Enacted (not yet in effect)
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
- Washington HB 1999 (criminalizes AI/fabricated CSAM and nonconsensual fake intimate images) · In effect
- Washington SB 5395 (limits AI in health-insurance prior-auth denials) · In effect
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for lo · Blocked / in litigation
- House Bill 2512 — Banning surveillance pricing by rideshare · Proposed / pending
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- NYDFS CL 7 (2024) — Insurance AI Anti-Discrimination · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.