Washington My Health My Data Act and AI: who it covers

The Washington My Health My Data Act protects health information that HIPAA never reaches, and it applies to any business that decides how that information is handled, with no revenue threshold and no list of industries. It demands consent before health data is collected or shared, a signed authorization before it is sold, and deletion on request. And unlike most state privacy laws, the person whose data was mishandled can sue.

That makes it the law to read before anyone in a Washington office pastes a customer’s health details into ChatGPT, Claude or Copilot. This page covers only what is specific to Washington. The federal layer is in our guide to which AI tools comply with US privacy law, and the other states are in the state by state overview.

Who the Washington My Health My Data Act covers

The act is chapter 19.373 of the Revised Code of Washington, passed on April 17, 2023 and signed on April 27, 2023 as chapter 191 of that year’s laws. The attorney general requested it, and calls it the first privacy law in the country focused on personal health data outside HIPAA.

A “regulated entity” in RCW 19.373.010 is any legal entity that conducts business in Washington, or produces or provides products or services targeted to Washington consumers, and alone or jointly determines the purpose and means of collecting, processing, sharing or selling consumer health data. Government agencies, tribal nations and their contracted service providers are outside it. No size or industry test narrows it.

Small businesses: covered, just later

The act defines a small business by volume: fewer than 100,000 consumers’ health data in a calendar year, or less than half of revenue from health data with fewer than 25,000 consumers. That definition does not exempt anyone. It only moved the start date for the main duties from March 31, 2024 to June 30, 2024, as the attorney general’s FAQ confirms.

Every duty on this page applies to an office of three, and the national guide shows how rare that is among state privacy laws.

Not only Washington residents

A “consumer” is a Washington resident, or any natural person whose consumer health data is collected in Washington. A visitor whose details are taken at a Seattle clinic is covered too. The definition then excludes anyone acting in an employment context, which takes employee and applicant files out of the act; our guide to AI for HR covers the rules that reach those instead.

MHMDA duty	From
Geofencing ban, for any person	July 23, 2023
Privacy policy, consent, rights, security, processors, sale	March 31, 2024
The same duties for small businesses	June 30, 2024

Washington Attorney General, My Health My Data Act FAQ, question 1.

What counts as consumer health data under the MHMDA

Consumer health data is personal information that is linked or reasonably linkable to a consumer and identifies their past, present or future physical or mental health status. Personal information includes data tied to a cookie ID, an IP address or a device identifier. The list that follows in RCW 19.373.010(8) is long, and it is not exhaustive.

Consumer health data includes	Where it turns up outside a clinic
Conditions, treatment, diagnoses, symptoms, vital signs	Customer emails, intake forms, claim notes
Use or purchase of prescribed medication	Pharmacy and delivery orders
Reproductive, sexual and gender affirming care information	App data, booking records
Biometric and genetic data	Face images, voice recordings, DNA test results
Precise location suggesting a visit for health care	Mileage logs, field visit records
Data identifying someone seeking health care services	Appointment reminders, referral letters
Health status inferred from nonhealth data, including by machine learning	Purchase histories, AI summaries

RCW 19.373.010(8)(b).

The last row is the one that matters for AI. The act counts information derived or extrapolated from nonhealth data, “including algorithms or machine learning”, when a business processes it to associate a consumer with a health status. The attorney general’s FAQ gives the example of a retailer assigning shoppers a pregnancy prediction score: protected, although inferred.

The same FAQ draws the line on the other side. A purchase of deodorant or toilet paper is not consumer health data; an app that tracks digestion or perspiration is. Non prescription medication counts only if the business draws an inference about health status from the purchase. The difference between this category and HIPAA’s is set out in our PHI and PII guide.

Faces count too

Biometric data in the act includes imagery of a face, iris, fingerprint, hand or voice from which an identifier template can be extracted, and the list of consumer health data names biometric data directly. A photo of an ID card is worth handling with that in mind, which is why our Washington driver’s license watermark tool works on the image in your browser and never uploads it.

Where HIPAA stops and Washington consumer health data starts

RCW 19.373.100 exempts information, not businesses. It steps aside for protected health information under HIPAA, health care information handled under chapter 70.02 RCW, substance use records under 42 CFR Part 2, research data under the federal human subjects rules, data de-identified to HIPAA’s standard, and information intermingled with those records at a covered entity, business associate or health care provider.

So a hospital’s patient chart is outside the act, but plenty of health information sitting in ordinary businesses is not. The space the act was built for is the one our guide to HIPAA compliant AI describes as falling outside PHI: wellness apps, gyms, retailers, life coaches, supplement shops and any website that infers health from behavior.

No threshold

Data under the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, FERPA and the insurance commissioner’s privacy rules is also exempt, as is processing to prevent fraud, security incidents or illegal activity, where the business carries the burden of showing it qualifies. Our guide to data anonymization before AI explains what “de-identified” has to mean before it takes data out of the act.

Consent to collect, and separate consent to share

From March 31, 2024, RCW 19.373.030 allows a regulated entity to collect consumer health data only with consent for a specified purpose, or to the extent necessary to provide a product or service the consumer asked for. Sharing follows the same pattern, with one addition: the consent to share must be separate and distinct from the consent to collect.

Consent means a clear affirmative act that is freely given, specific, informed, opt in and unambiguous. It cannot come from accepting general terms of use, from hovering over, muting or closing content, or from a deceptive design.

The privacy policy gets its own link

RCW 19.373.020 requires a consumer health data privacy policy, and the attorney general’s FAQ adds that it must be a separate link on the homepage and may not contain information the act does not require.

The health data privacy policy must disclose	The consent request must disclose
Categories collected, and the purpose and use	Categories collected or shared
Categories of sources	Purpose, and the specific ways the data will be used
Categories shared, and with which third parties and affiliates	Categories of recipients
How to exercise the act’s rights	How to withdraw consent

RCW 19.373.020(1)(a) and 19.373.030(1)(c).

Collecting a new category, or using data for a purpose the policy does not disclose, needs disclosure and fresh consent first. A business that starts running customer notes through an AI service for a new purpose is in that position, and the wording belongs in the US AI policy template.

Selling consumer health data needs a signed authorization

RCW 19.373.070 makes it unlawful for any person, not only a regulated entity, to sell or offer to sell consumer health data without a valid authorization signed by the consumer. A sale is an exchange for money or other valuable consideration; passing data to a processor consistently with the purpose for which it was collected is not one.

A valid authorization must contain
The specific data to be sold	The buyer’s name and contact details
The seller’s name and contact details	The purpose and how the buyer will use it
A statement that service cannot depend on signing	A right to revoke at any time, and how
A warning that the buyer may redisclose it	An expiry one year after signing, and the signature and date

RCW 19.373.070(2). Seller and buyer keep a copy for six years.

Few offices sell health data on purpose. The question an AI user should ask is whether a free service that keeps prompts for its own use is getting data in exchange for something of value, which our guide to what ChatGPT does with your data helps answer plan by plan.

Deletion, access and the 45 day clock

RCW 19.373.040 gives consumers four rights: to confirm whether a business collects, shares or sells their health data and to see it, with a list of every third party and affiliate that received it; to withdraw consent; to have it deleted; and to appeal a refusal. Responses are due within 45 days, extendable once by 45 more, and are free up to twice a year.

Deletion reaches past the business itself. The business must delete the data from every part of its network, with backups allowed up to six months, and notify every affiliate, processor, contractor and third party it shared the data with, each of which must delete it too. An AI vendor that received a client’s details is on that list, and our guide to deleting ChatGPT history shows what a user can and cannot remove from their side.

45 daysto answer a request, extendable once

6 monthsat most to clear backups after deletion

2,000 feetthe geofencing limit around care sites

RCW 19.373.050 adds two duties that apply every day: limit access to consumer health data to the employees, processors and contractors who need it for the consented purpose or the requested service, and keep security practices that meet the reasonable standard of care in your industry.

Geofencing: 2,000 feet around a place that provides care

RCW 19.373.080 makes it unlawful for any person to set a geofence around an entity that provides in person health care services where it is used to identify or track people seeking care, collect their health data, or send them notifications or ads about their health data or care. The definition caps the boundary at 2,000 feet from the site’s perimeter.

The rule took effect on July 23, 2023, months before the rest of the act, and Connecticut’s equivalent stops at 1,750 feet around a narrower set of facilities, as our Connecticut Data Privacy Act page sets out. Photos carry location too: removing metadata from photos before they leave the office keeps a clinic visit out of a file.

MHMDA lawsuits: the Consumer Protection Act and its private right

RCW 19.373.090 declares that the practices the act covers vitally affect the public interest, and that a violation is an unfair or deceptive act in trade or commerce under the Consumer Protection Act, chapter 19.86 RCW. That one sentence brings in both of the CPA’s enforcers: the attorney general and the person harmed.

Who sues	What they can recover
A person injured in business or property, RCW 19.86.090	Actual damages, costs and a reasonable attorney’s fee
The same, at the court’s discretion	Up to three times the damages, the increase capped at $25,000
The attorney general, RCW 19.86.140	Civil penalties of up to $7,500 per violation

RCW 19.86.090 and 19.86.140, read October 13, 2026.

Attorney’s fees are what make a private claim worth bringing even when individual damages are small. Texas and Connecticut leave their privacy laws to the attorney general alone, as our Texas page explains, so Washington is where a health data claim can come from a customer rather than the state. The state by state overview compares the rest.

Consumer health data in AI prompts when HIPAA does not apply

Take a personal training studio in Spokane, or an online supplement store in Tacoma, neither of them a HIPAA covered entity. Someone pastes a customer’s notes about an injury or a medication into a chatbot to draft a reply. Under the act, that text is consumer health data, the business is a regulated entity, and the chatbot provider is either a processor or a third party.

When the AI vendor is a processor

RCW 19.373.060 lets a processor handle consumer health data only under a binding contract that sets the processing instructions and limits what it may do, and only within those instructions. A business plan with a data processing agreement and no training on inputs fits that shape. Under RCW 19.373.020(1)(e), contracting with a processor in a way that departs from your own health data privacy policy is itself a violation.

When it is not

If the provider processes the data outside the contract, the act treats it as a regulated entity for that data. And a disclosure to anyone other than a processor working consistently with the original purpose is “sharing”, which needs its own consent, separate from the consent to collect. A personal chatbot account with training switched on is hard to describe as a processor; our Claude guide shows where those settings sit.

How the AI provider receives the notes	Its position under RCW 19.373	What it means for you
Under a binding contract, within its instructions	Processor	Not sharing, if consistent with your policy
Under a contract, but used beyond it	Regulated entity for that data	The provider answers for its own use
With no processing contract at all	Third party	Sharing, which needs separate consent

RCW 19.373.010(21), (27) and (29), and 19.373.060.

The summary the AI writes is health data too

Because the definition includes health status inferred by machine learning, an AI summary saying a customer “appears to have a chronic back condition” creates consumer health data even from notes that never named one. The output then needs the same care as the input. The safer workflow is the one in what personal information to remove before AI: take the name and identifiers out first, so the inference attaches to nobody.

Breach notice in Washington: 30 days

RCW 19.255.010 requires notice to affected Washington residents in the most expedient time possible and within 30 calendar days of discovering a breach, unless it is not reasonably likely to put them at risk of harm, and notice to the attorney general within the same 30 days if more than 500 residents are affected. The notice to the attorney general includes the number affected and a sample of the letter.

Washington’s definition of personal information, in RCW 19.255.005, includes a name combined with medical history, a mental or physical condition, a diagnosis or treatment, or a health insurance number, and full date of birth, among other elements. Whether pasting such data into an AI tool is a breach at all is a separate question, covered in our guide on whether putting client data in ChatGPT is a data breach.

A Washington checklist for consumer health data and AI

In the order a Washington business can work through it:

1. Find the health data. Look for conditions, medication, injury notes, location near care sites and anything an AI tool infers about health.
2. Publish the separate policy. A consumer health data privacy policy, linked on its own from the homepage.
3. Get two consents, or none needed. Collect only for a requested service or with consent, and share only with separate consent.
4. Paper the AI vendor as a processor. A binding contract with instructions and limits, consistent with your policy.
5. Route deletions to the vendor. A deletion request reaches every processor that received the data.

Items 3 and 4 belong in your AI policy, and item 1 pairs with the HIPAA guide’s list of identifiers.

Nonimo for Washington health notes

Nonimo is an app for Mac and Windows that works on the text before it reaches ChatGPT, Claude or Copilot. The trainer at that Spokane studio highlights the injury notes and presses one key, and the client’s name and phone number become placeholders on that computer. When the answer comes back, the real details go back in on the same machine.

Under the My Health My Data Act, that means a note about an injury reaches the AI provider without the person attached, so fewer consumers’ health data sits with a processor and fewer deletion requests have to travel. The injury itself stays in the text, so the notes still need the care the act asks for on your side.

The conversation stays on the computer, encrypted, and what the app sends out is a daily usage count with no text, as the security page sets out. Start from Nonimo for US teams, or see the Nonimo page for healthcare.

Sources

Read October 13, 2026.

• Washington State Legislature, RCW 19.373, full chapter: 19.373.010 (definitions: consumer, consumer health data, biometric data, geofence, regulated entity, small business, sale, sharing), 19.373.020 (privacy policy), 19.373.030 (consent to collect and share), 19.373.040 (rights, deletion, 45 days), 19.373.050 (access and security), 19.373.060 (processors), 19.373.070 (valid authorization to sell), 19.373.080 (geofencing), 19.373.090 (Consumer Protection Act), 19.373.100 (exemptions); chapter 191, Laws of 2023, with no later amendment shown.
• Washington Attorney General, Protecting Washingtonians’ personal health data and privacy: passage April 17, 2023, signature April 27, 2023, effective dates, separate homepage link, examples on toiletries, inferences and non prescription medication.
• Washington State Legislature, RCW 19.86.090: private action, actual damages, attorney’s fees, trebling capped at $25,000.
• Washington State Legislature, RCW 19.86.140: civil penalty of up to $7,500 per violation.
• Washington State Legislature, RCW 19.255.010 and RCW 19.255.005: breach notice within 30 days, attorney general above 500 residents, health data in the definition of personal information.