Washington's My Health My Data Act and AI-Inferred Health Data

Most state privacy statutes regulate data a consumer hands you. Washington’s My Health My Data Act, chapter 19.373 RCW, regulates a conclusion your system reaches — including a conclusion drawn from data that is not health data at all. For anyone running inference over consumer behaviour, that single clause is the whole statute.

The definition that does the work

The Act was signed on 27 April 2023 and took effect on 31 March 2024 for most regulated entities, with a later date for small businesses as the Act defines them. Its operative term is “consumer health data”, defined in RCW 19.373.010 as personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present or future physical or mental health status. The definition then adds the clause that makes this page necessary: the category expressly includes information that is derived or extrapolated from nonhealth information, and the statute names proxy data and shopping data as examples.

The enumerated sub-categories are unusually wide. They include individual health conditions, treatments, diseases and diagnoses; social, psychological, behavioural and medical interventions; use or purchase of prescribed medication; bodily functions, vital signs and symptoms; reproductive and sexual health information; gender-affirming care information; biometric data; precise location information that could reasonably indicate an attempt to acquire or receive health services or supplies; and data that identifies a consumer as seeking health care services.

Inference as an act of collection

Put the derived-data clause next to the Act’s definition of “collect”, which covers buying, renting, accessing, retaining, receiving, acquiring, inferring, deriving or otherwise processing consumer health data in any manner. Inference is named as a form of collection. That produces a result which has no analogue in the other state privacy laws: a pipeline that ingests only ordinary commerce data can become a collector of consumer health data at the moment the model produces an output, without anything new entering the system.

Concretely, the systems most exposed are the ones nobody built as health products. A propensity model that scores a shopper as likely pregnant. A recommendation system whose embedding neighbourhood is effectively a diagnosis. A support assistant that classifies a ticket as being about a medication. A location-based feature that distinguishes a visit to a clinic from a visit to the shop next door. Each of these produces something that identifies a health status, and the Act attaches to the output rather than to the input.

A practical consequence for anyone building on models: the boundary of your regulated data set is not the boundary of your database schema. Free-text fields, model outputs, log lines containing an assistant response, and vector stores can all hold consumer health data by derivation. Retention and deletion tooling built around a “health data” column will miss all of it, and the Act’s deletion right requires a regulated entity to delete consumer health data from its records and to notify affiliates, processors and contractors to do the same.

Consent, and the separate authorisation to sell

The Act runs two distinct permissions and they are not interchangeable. Collection and sharing require consent: it must be obtained prior to the collection, must be separate and distinct from any other consent, and cannot be bundled into a terms-of-service acceptance or obtained through a deceptive design. Consent is unnecessary only where the collection or sharing is necessary to provide a product or service the consumer has requested — a narrow lane, and one that an inference drawn for the entity’s own analytics does not sit in.

Selling consumer health data requires something else entirely: a valid authorisation, signed by the consumer, separate from consent, and containing a list of specified contents including the specific health data to be sold, the identity of the purchaser, the purpose, and an expiry no later than one year from signature. Copies must be retained for six years. The practical effect is that an authorisation-based sale of inferred health data is close to unworkable at scale, which appears to have been the point.

The chapter also bans implementing a geofence around an in-person health care facility — the ban is drawn at 2,000 feet — where the purpose is to identify or track consumers seeking health services, collect their consumer health data, or send them related advertisements. That prohibition took effect before the rest of the Act, in July 2023, and it applies to any person, not only to regulated entities.

Who is a regulated entity

A regulated entity is any legal entity that conducts business in Washington or produces products or services targeted to Washington consumers, and that alone or jointly determines the purpose and means of collecting, processing, sharing or selling consumer health data. There is no revenue floor and no minimum consumer count. That is the second reason this statute is unusual: the comprehensive privacy laws in Virginia, Oregon and Delaware all have applicability thresholds, and a small startup falls outside them. Washington’s applies to a two-person company that targets Washington consumers.

“Consumer” is also drawn oddly. It covers a natural person who is a Washington resident or whose consumer health data is collected in Washington, and it excludes individuals acting in an employment context. So the question is not only where your users live.

The exemptions are data-level rather than entity-level for the most part. Protected health information governed by HIPAA is exempt as data, as is health care information under Washington’s own chapter 70.02 RCW, information used for public health activities, and de-identified data meeting the Act’s standard. A HIPAA-covered provider is therefore not exempt as an organisation: the marketing analytics it runs outside the HIPAA perimeter can still be in scope.

Why the private right of action changes the maths

The Act declares a violation to be an unfair or deceptive act in trade or commerce and an unfair method of competition for the purposes of the Washington Consumer Protection Act, chapter 19.86 RCW. That is the hook, and it is the only one of its kind among the recent US privacy statutes: it makes the Act privately enforceable, with the CPA’s treble-damages and attorney-fee provisions behind it, rather than leaving enforcement to the Attorney General alone.

What that means in practice is still being worked out. Putative class actions invoking the Act were filed from early 2025 onwards, and at the time of writing none has produced a merits ruling construing the derived-data clause — the open questions include whether a CPA claim still requires a showing of injury and public interest impact, and how the Act interacts with the CPA’s own elements. State what is decided, which is nothing, rather than what is likely.

For a designer of AI systems the defensible reading is the simple one: if a model can produce an output that identifies a health status, treat that output as consumer health data from the moment it exists, and build the consent, the retention limit and the deletion path around the output rather than around the input. Neighbouring states are heading the same way in narrower forms — Nevada’s SB 370 uses a similar consumer-health-data structure, and Connecticut amended its own privacy act to cover consumer health data — but Washington is currently the only one carrying a private right of action.