HIPAA Compliance in Washington: My Health My Data Act
Washington healthcare organizations must comply with federal HIPAA plus the My Health My Data Act and other state privacy laws. This guide covers the My Health My Data Act (Washington's consumer health data law), Uniform Health Care Information Act, and other Washington requirements that extend beyond HIPAA.
Washington imposes healthcare privacy through multiple frameworks: HIPAA (federal), the My Health My Data Act (RCW 19.255.010 et seq.), Uniform Health Care Information Act (RCW 70.02.005), and data breach notification laws. The My Health My Data Act is particularly significant: it restricts the sale and use of health data for certain purposes (targeted advertising, insurance/employment decisions, preventive health purposes), even when patients initially consent. Additionally, Washington requires patient data access in accessible formats, restricts secondary uses of health data, and allows enforcement by both the Washington Attorney General and private consumer lawsuits. Healthcare organizations must comply with overlapping requirements across all frameworks.
How Washington Law Extends Beyond HIPAA
Washington law creates unique privacy obligations for consumer health data:
1. My Health My Data Act (RCW 19.255.010 et seq.)
Washington's comprehensive health data law applies to entities handling consumer health data:
- Scope: Applies to entities (including healthcare providers) collecting consumer health data that are not regulated as covered entities under HIPAA
- Definition: Consumer health data includes information about health status, medical treatment, biometric information, genetic information, reproductive health, mental health, substance abuse treatment, and health behaviors
- Sale restrictions: Health data cannot be sold; requires explicit authorization for any secondary use
- Targeted advertising prohibition: Health data cannot be used for targeted health or wellness advertising (with limited exceptions)
- Insurance/employment restrictions: Health data cannot be used to make insurance or employment decisions (with exceptions for health plans)
- Preventive health limitations: Even with authorization, health data use for preventive purposes is restricted
- Consumer rights: Right to access, correct, delete, and port health data
- Enforcement: Washington Attorney General and private consumer lawsuits
2. Uniform Health Care Information Act (RCW 70.02.005 et seq.)
State law governing healthcare information privacy for all providers:
- Authorization requirements: Written authorization for disclosure of health information; specific authorization for sensitive information
- Patient rights: Right to access records, request amendments, and receive disclosure accounting
- Applicability: Applies to all healthcare providers and entities handling health information
- Enforcement: Washington Attorney General and private remedies
3. Washington Data Breach Notification Law (RCW 19.255.010, RCW 19.86)
Requires notification of breaches of personal information:
- Timeline: Without unreasonable delay; interpreted as prompt notification
- Scope: Applies to breaches of personal information, including health data
- Content: Notice must describe breach and available resources
4. Washington Consumer Protection Act (RCW 19.86)
Provides enforcement authority for unfair healthcare practices:
- Private right of action: Consumers can sue for healthcare privacy violations
- Damages: Actual damages, statutory damages (up to $2,000 per violation), and attorney fees
- Healthcare privacy: Can include violations of health data protection requirements
5. Washington Mental Health & Substance Abuse Confidentiality
Additional protections for sensitive health information:
- Mental health treatment: Enhanced confidentiality protections beyond HIPAA
- Substance abuse treatment: Federal 42 CFR Part 2 plus Washington law applies; stricter requirements
Key Washington State Statutes & References
Washington Attorney General Enforcement
Washington enforces healthcare privacy and consumer health data laws through multiple mechanisms:
- My Health My Data Act enforcement: Washington AG enforces the law against entities violating consumer health data restrictions
- HIPAA enforcement: Washington AG enforces HIPAA violations in Washington
- Data breach enforcement: Investigates breaches and enforces breach notification requirements
- Consumer Protection Act enforcement: AG pursues unfair healthcare practices
Enforcement activity: Washington AG has indicated active enforcement of the My Health My Data Act, particularly against entities using health data for targeted advertising or insurance/employment purposes without proper authorization.
Comparison: HIPAA vs. Washington State Requirements
| Area | HIPAA | Washington Law | More Stringent |
|---|---|---|---|
| Sale of Health Data | Generally permitted with authorization | My Health My Data: Sale prohibited; no exceptions | Washington |
| Targeted Health Advertising | Generally permitted with authorization | My Health My Data: Prohibited; limited exceptions | Washington |
| Insurance Use of Health Data | Permitted for certain purposes | My Health My Data: Prohibited except for direct insurer uses | Washington |
| Employment Use of Health Data | Limited restrictions | My Health My Data: Prohibited for employment decisions | Washington |
| Authorization for Disclosure | General authorization acceptable | Uniform Act: Specific authorization for sensitive data | Washington |
| Breach Notification | 60 days of discovery | Without unreasonable delay | Washington |
| Private Right of Action | No private HIPAA right for patients | My Health My Data and Consumer Protection Act allow lawsuits | Washington |
| Statutory Damages Available | Not for patients | Up to $2,000 per violation under Consumer Protection Act | Washington |
Washington-Specific Health Data Restrictions
My Health My Data Act Prohibitions
- Sale prohibition: Cannot sell consumer health data; applies to all entities not regulated as HIPAA covered entities
- Targeted advertising: Cannot use health data to create targeted health or wellness advertisements; limited exceptions for direct-to-consumer health information
- Insurance decisions: Cannot use health data to determine insurance eligibility, rates, or coverage (except direct health insurer use)
- Employment decisions: Cannot use health data in employment decisions (hiring, firing, compensation)
- Preventive health restrictions: Even with authorization, use for preventive health purposes is limited
Consumer Health Data Rights
- Right to access: Consumers can obtain copy of health data; must respond within 30 days
- Right to correct: Consumers can request corrections to inaccurate data
- Right to delete: Consumers can request deletion (with exceptions for legal requirements, security)
- Right to port: Consumers can request data in portable, transferable format
Data Breach Notification
- Timeline: Without unreasonable delay; Washington AG interprets as prompt notification
- Content: Description of breach, information types involved, company response
- Method: Written notice by mail, email, or telephone
Frequently Asked Questions
The My Health My Data Act explicitly applies to entities that are NOT regulated as HIPAA covered entities or business associates. So if you're a HIPAA covered entity, the My Health My Data Act does not directly apply to your core healthcare functions. However, if you operate non-HIPAA-regulated health-related services (health apps, wellness platforms, health data analytics, third-party health information systems), those may be subject to the law. Additionally, even HIPAA covered entities should be aware of the Act's principles, as Washington may expand it or as you engage with non-HIPAA regulated vendors.
Generally no. The My Health My Data Act prohibits using health data to create targeted health or wellness advertisements. There is a narrow exception for direct-to-consumer health information (like health tips from your doctor), but commercial targeted advertising using consumer health data is prohibited. Even if a consumer gave authorization, the prohibition stands. This is a significant limitation compared to HIPAA, which permits marketing communications with authorization. If your organization uses health data for any form of targeted advertising to Washington residents, you're likely violating the law.
No. The My Health My Data Act absolutely prohibits the sale of consumer health data. Even if Washington residents consent, you cannot sell their health data. This is a bright-line rule with no exceptions based on authorization. If your business model involves selling health data to third parties (for research, marketing, analytics), you cannot do so for Washington residents. This applies to all entities except those regulated as HIPAA covered entities/business associates, so non-traditional healthcare entities (health apps, analytics firms, health data brokers) are particularly affected.
My Health My Data Act violations can be pursued as consumer protection violations under Washington Revised Code §19.86. This means consumers can sue directly for: (1) Actual damages (costs they incurred from the violation), (2) Statutory damages up to $2,000 per violation, and (3) Attorney fees and court costs. If the violation is "knowing" or "intentional," damages can be doubled. Unlike HIPAA, which only allows government enforcement, Washington's law creates private litigation risk for each violation. A single unauthorized use of health data affecting multiple consumers could result in thousands of dollars in statutory damages per consumer, plus attorney fees.
Protect Your Washington Healthcare Organization
Washington's My Health My Data Act creates new restrictions and consumer rights. Get a professional security assessment to ensure compliance with HIPAA, the My Health My Data Act, and Washington privacy laws.
Get Your Security Assessment