Washington health-data law puts ordinary tracking tools in the litigation line of fire

Washington’s My Health My Data Act reaches beyond healthcare providers, exposing lenders, software companies and other businesses to liability for health-related inferences drawn from everyday tracking and analytics.

Washington State’s consumer health data law is forcing a wider group of companies to rethink what they collect, how they label it and where they share it. The My Health My Data Act was signed in 2023 and took effect for most businesses on 31 March 2024, but its reach is broader than many firms first assumed. According to legal analyses of the statute, it can apply to businesses that have no obvious healthcare role at all, so long as they process personal information linked, or reasonably linkable, to a consumer’s physical or mental health.

The statute’s definition is central to that reach. It covers information such as diagnoses, treatments, reproductive and sexual health data, biometric and genetic information, and precise location data that may indicate an attempt to obtain health services. It also extends to inferences, which means a company does not need to ask directly about health in order to create regulated health data through analytics, tracking tools or location-based advertising. The law also bars geofencing within 2,000 feet of health-service facilities for tracking or health-related advertising purposes.

For many financial institutions, the first question is whether existing federal privacy obligations already shield them. The answer is only partial. Legal summaries of the Act note that exemptions operate at the data level, not simply at the level of the organisation, so information governed by the Gramm-Leach-Bliley Act or the Fair Credit Reporting Act may be outside the statute, while marketing pixels, app analytics and other unrelated data flows can still fall within scope. By contrast, HIPAA has a broader entity-level exemption, which is one reason hospitals and lenders face different levels of concern under the same state law.

Enforcement is what gives the Washington law added force. Unlike some other state privacy laws, it includes a private right of action, allowing consumers to sue under the state’s Consumer Protection Act rather than waiting for public enforcement alone. Commentators have noted that this design is likely to drive litigation, especially because the statute is written broadly and extends beyond traditional healthcare businesses. The law also applies to entities doing business in Washington or targeting Washington consumers, without revenue or processing thresholds to narrow its scope.

That combination of breadth and private enforcement has implications for lenders, telecoms and software companies. A loan application tied to medical expenses, a customer journey that reveals treatment-related searches, or a mobile app that records location data near a clinic can all become part of a health-data theory if the surrounding facts support it. Software vendors can be especially exposed because their tools are often embedded across large numbers of third-party sites and apps, which makes the same tracking code relevant to many businesses at once.

The practical response is increasingly familiar, even if the legal risk is new. Companies need a detailed inventory of trackers, pixels, tags and software development kits, a map of where data moves, consent mechanisms that actually work, and vendor contracts that match the law’s requirements. Legal guidance on the Act also points to opt-in consent before collection or sharing of consumer health data, binding contracts with service providers, and clear internal review of any data flow that could be read as health-related. For organisations that rely on digital advertising or app analytics, the issue is no longer whether they think of themselves as health companies. It is whether their data practices could persuade a court that they are handling consumer health data already.