---
title: "Consumer Health Data: Washington My Health My Data Act"
description: "Washington's My Health My Data Act covers health data HIPAA does not. What counts as consumer health data, consent rules, and what it means for telehealth."
canonical: "https://cuvo.co/glossary/consumer-health-data"
last-updated: "Oct 26, 2026"
---
**Definition:** Under Washington's My Health My Data Act (RCW 19.373), consumer health data is personal information linked or reasonably linkable to a consumer that identifies their past, present or future physical or mental health status; HIPAA-protected data is exempt.

# What is consumer health data under Washington law?

HIPAA protects health data held by covered entities, including most health care providers, and their vendors. Washington's My Health My Data Act reaches the rest, including the storefronts, quizzes and ad tools of brands that sell health products to Washington residents. Cuvo Health runs the clinical layer on HIPAA-compliant infrastructure, and the brand governs its own consumer data.

Published Oct 26, 2026. Facts reviewed Oct 26, 2026.

Consumer health data is the category Washington's My Health My Data Act, RCW 19.373, protects: personal information linked or reasonably linkable to a consumer that identifies their past, present or future physical or mental health status. RCW 19.373.010 lists what that includes, among it diagnoses, the use or purchase of prescribed medication, biometric and genetic data, precise location that could indicate a person is seeking care, and health inferences drawn from other data. The law reaches entities that do business in Washington or target its consumers, and it exempts HIPAA protected health information. On Cuvo Health, the clinical layer runs on HIPAA-compliant infrastructure under a business associate agreement on every plan, while the brand owns its customer and storefront data and decides with counsel how they meet Washington's rules.

**At a glance**
- What it is: Washington's term for personal information that identifies a consumer's health status
- Law: My Health My Data Act, RCW 19.373, enacted as 2023 c 191
- In force: March 31, 2024 for regulated entities; June 30, 2024 for small businesses
- Who it reaches: Entities doing business in Washington or targeting Washington consumers
- Exempt: HIPAA protected health information, among other categories (RCW 19.373.100)
- On Cuvo: The clinical layer on HIPAA-compliant infrastructure under a BAA on every plan

**What the My Health My Data Act requires (RCW 19.373, read October 26, 2026)**

| Duty | What the law says | RCW |
| --- | --- | --- |
| **Privacy policy** | Maintain a consumer health data privacy policy and link it prominently on the homepage | 19.373.020 |
| **Consent to collect** | Consent for a specified purpose, unless the data is necessary for a product or service the consumer requested | 19.373.030(1)(a) |
| **Consent to share** | A separate and distinct consent, with the same exception | 19.373.030(1)(b) |
| **Consumer rights** | Confirm and access the data, see the third parties it went to, withdraw consent, and have it deleted | 19.373.040 |
| **Selling** | A valid authorization signed by the consumer, separate from consent | 19.373.070 |
| **Geofencing** | No geofence within 2,000 feet of an in-person health care site to track, collect data or send health messages | 19.373.080 |
| **Enforcement** | A violation is an unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW | 19.373.090 |

## 01. Does the My Health My Data Act apply to a telehealth brand?

It can, wherever the brand handles health data outside HIPAA. A consumer under the law is a Washington resident or anyone whose consumer health data is collected in Washington, and a regulated entity is any business that does business in Washington or targets its consumers and decides why and how the data is collected. A national brand's storefront orders, eligibility quizzes and analytics can hold exactly the data the law lists, including the purchase of prescribed medication and data identifying someone seeking care.

## 02. How is consumer health data different from PHI?

Whether data is protected health information turns on who holds it: a HIPAA covered entity or its business associate. Consumer health data is defined by what it reveals, whoever holds it, and RCW 19.373.100 exempts protected health information from the Washington law. The same person's information can therefore be PHI in the treating practice's chart and consumer health data in a brand's storefront, under different rules. On Cuvo, the chart belongs to the treating professional corporation and sits on HIPAA-compliant infrastructure, and the brand owns its customer list and business records.

## 03. What does the law mean for ad pixels and audiences?

Sharing under RCW 19.373.010 means releasing, disclosing or otherwise making consumer health data available to a third party or affiliate, so a tracking tool that sends consumer health data from a storefront to an ad platform shares it and needs the separate sharing consent unless an exception applies. Selling the data needs a signed authorization, and geofencing around health care sites to target health ads is barred outright. This is general information, not legal advice.

**Primary sources**
- [RCW 19.373: Washington My Health My Data Act](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373&full=true): Washington State Legislature, read Oct 26, 2026
- [45 CFR 160.103: protected health information](https://www.ecfr.gov/current/title-45/section-160.103): The HIPAA category the Washington law exempts

## Frequently asked questions

**Q: What is the Washington My Health My Data Act?**

A: It is Washington's consumer health privacy law, RCW 19.373, in force since March 31, 2024, which requires consent to collect consumer health data, a separate consent to share it, a signed authorization to sell it, and a published consumer health data privacy policy. On Cuvo, the clinical layer runs on HIPAA-compliant infrastructure under a business associate agreement, and the brand governs its own consumer data.

**Q: What is consumer health data?**

A: Under RCW 19.373.010 it is personal information linked or reasonably linkable to a consumer that identifies their physical or mental health status, including purchases of prescribed medication, diagnoses, biometric and genetic data and health inferences drawn from other data. On Cuvo, the clinical record sits on HIPAA-compliant infrastructure under a business associate agreement, and the brand owns its customer list.

**Q: Does the My Health My Data Act apply to HIPAA-covered data?**

A: No. RCW 19.373.100 exempts protected health information under HIPAA, along with several other regulated categories, so the law reaches health data held outside HIPAA. On Cuvo, intake, charts and prescriptions run under a business associate agreement signed on every plan.

**Q: Does the My Health My Data Act apply to businesses outside Washington?**

A: Yes, when they do business in Washington or target Washington consumers, and the consumers it protects include anyone whose health data is collected in Washington. On Cuvo, a national brand runs its clinical layer on Cuvo's HIPAA-compliant infrastructure and decides with counsel how its storefront meets Washington's consent rules.

**Q: What does a telehealth brand need to comply with the My Health My Data Act?**

A: A consumer health data privacy policy linked on its homepage, consent before collecting data it does not need for the requested service, a separate consent before sharing, a process for access and deletion requests, and no geofenced health targeting. On Cuvo, the clinical layer runs on HIPAA-compliant infrastructure under a business associate agreement, and a documented FTC Health Breach Notification Rule process covers the brand's consumer-facing surfaces.

**Related pages**

- [How to legally offer GLP-1s through a wellness brand](/blog/legal-checklist-offer-glp1-through-a-wellness-brand): Data laws in the full legal checklist, Washington included
- [Protected health information (PHI)](/glossary/protected-health-information): The HIPAA category the Washington law exempts
- [FTC Health Breach Notification Rule](/glossary/ftc-health-breach-notification-rule): The federal rule for health data outside HIPAA
- [FTC rules for telehealth subscriptions and health ads](/blog/ftc-rules-for-telehealth-subscriptions-and-health-ads): Keeping health data out of the ad stack
- [Cuvo compliance](/compliance): HIPAA infrastructure and the FTC breach process Cuvo runs
- [Telehealth glossary](/glossary): Every term a telehealth founder meets

Canonical page: https://cuvo.co/glossary/consumer-health-data