Multi-state reference · Updated 2026
Consumer Health Data Privacy Laws by State
For years, "health data law" meant HIPAA, and HIPAA only covers providers, plans, clearinghouses and their business associates. That left almost every app, retailer, wellness vendor and marketing platform outside its scope. Three states have now closed that gap with dedicated consumer health data rules — and they don't all work the same way.
In short: Washington (RCW 19.373), Nevada (SB 370) and Connecticut (CTDPA, as amended) all require a separate health-data privacy notice, opt-in consent, a distinct authorization to sell, and all three ban geofencing around health facilities. The biggest practical difference is who can sue you: Washington is the only one generally understood to let individual consumers bring their own claims. Generate your Washington documents or check whether you're in scope.
| Washington | Nevada | Connecticut | |
|---|---|---|---|
| Statute | My Health My Data Act (RCW 19.373) | SB 370 (2023) | CTDPA, amended by Public Act 23-56 |
| Main obligations took effect | 2024 | 2024 | 2023 |
| Separate health-data privacy notice | Required | Required | Folded into the broader CTDPA notice |
| Opt-in consent to collect & share | Required | Required | Required |
| Separate authorization to sell | Required | Required | Required |
| Geofencing ban near health facilities | Yes | Yes (1,750 ft) | Yes (1,750 ft) |
| Consumers can sue directly | Generally yes, via the state Consumer Protection Act | No — Attorney General enforcement | No — Attorney General enforcement |
| Small-business size exemption | No | No | Yes — CTDPA applicability thresholds apply |
| Covered by this generator today | Yes | Not yet | Not yet |
Accuracy note: This table summarises publicly available statutes as of this page's last update and is written in plain English rather than statutory language. It's general information to help you scope your situation — not legal advice, and not a substitute for reading the current text of each statute or speaking with counsel licensed in that state. Legislatures amend these laws regularly; please verify anything you plan to rely on.
Read the full state-by-state breakdown
Washington — My Health My Data Act (RCW 19.373)
Washington's law is the broadest and, for most businesses, the highest-risk of the three. It defines consumer health data expansively — anything that identifies a person's past, present or future physical or mental health status, including inferences drawn from non-health data. There is no revenue or headcount exemption. Most importantly, Washington's act is generally understood to be enforceable by individual consumers through the state's Consumer Protection Act, which means class-action exposure rather than only regulator attention. That's why the first major case arrived as a private class action rather than an Attorney General enforcement action. See the full Washington guide or the provision-by-provision compliance map.
Nevada — SB 370
Nevada's law was passed in the same wave and mirrors much of Washington's structure: a standalone consumer health data privacy notice, opt-in consent before collecting or sharing, a separate written authorization before selling, consumer rights to access and delete, and a ban on geofencing within 1,750 feet of a health care facility. The practical difference is enforcement — Nevada's is handled by the Attorney General under the state's deceptive trade practices framework rather than by private plaintiffs. That lowers class-action risk considerably, but it does not make the obligations optional. Read the Nevada overview →
Connecticut — CTDPA as amended
Connecticut took a different route: rather than passing a standalone health-data statute, it amended its existing comprehensive privacy law to add consumer health data as a protected category. The result is that Connecticut's health-data rules only bite if you already meet the CTDPA's applicability thresholds — which are based on how many Connecticut consumers' data you process — so unlike Washington and Nevada, there genuinely is a size-based filter. Once you're in scope, though, the substance is familiar: consent before processing consumer health data, no selling without consent, and a geofencing ban around mental health and reproductive or sexual health facilities. Read the Connecticut overview →
What's the same in all three
- HIPAA doesn't save you. All three were written specifically to reach data that HIPAA leaves unregulated. Being "not a covered entity" is the reason these laws apply to you, not a reason they don't.
- Consent must be opt-in and unbundled. None of the three accept consent buried in a general terms-of-service acceptance, and all three reject dark patterns.
- Selling requires its own separate authorization. A consent to collect and share is not sufficient to sell.
- Geofencing near health facilities is prohibited outright. This isn't a consent-based rule — you can't obtain permission to do it.
- Inferences count. Deriving a health status from shopping history, location or app behaviour creates regulated data even if the consumer never told you anything medical.
What differs, and why it matters commercially
- Litigation exposure. Washington's private right of action is the single biggest risk differentiator. A Nevada or Connecticut violation typically means regulator attention; a Washington violation can mean a class action funded by plaintiffs' firms.
- Applicability thresholds. Washington and Nevada apply regardless of size. Connecticut layers its health-data rules on top of thresholds, so a genuinely small business may be out of scope there while fully in scope in Washington.
- Notice architecture. Washington and Nevada expect a distinct, separately-linked consumer health data privacy notice. Connecticut generally expects the disclosures inside your main privacy notice.
- Cure periods. Connecticut has operated with a right-to-cure mechanism for some violations; Washington's private-action route offers no equivalent comfort.
Which states might be next
Consumer health data bills modelled on Washington's have been introduced in several other legislatures, and the general trend is toward more states regulating health-adjacent data outside HIPAA. We deliberately don't list bills that haven't passed, because pending legislation changes shape constantly and planning against a draft is rarely useful. The practical planning assumption for most businesses is: build to Washington's standard, because it's currently the strictest, and adapting downward to a less demanding state is far easier than the reverse.
A realistic multi-state approach
If you operate nationally, the common pattern is to (1) establish whether you're in scope in Washington first, since it has no size exemption and the highest litigation risk, (2) build a Washington-grade consent, notice, authorization and rights-request process, then (3) have counsel review whether your Nevada and Connecticut obligations are satisfied by that same infrastructure or need state-specific language. Very few businesses find it practical to run three entirely separate compliance programs.
Start with the strictest state
The Compliance Pack generates five Washington-specific draft documents — privacy policy, consent form, sale authorization, retention schedule and rights request form — from a short questionnaire. Washington is the toughest of the three standards, which makes it a sensible baseline. You can read every document in full, free, before deciding to pay.
Generate My Compliance Pack — $99.99Washington (RCW 19.373) documents only — Nevada and Connecticut aren't generated today.
Scope & limitations of this page
This comparison is a general-information summary of three state statutes, written for business owners rather than lawyers. It doesn't cover every provision, exemption or definitional nuance in any of the three laws, and it can't tell you whether a specific data flow in your business is compliant. It also isn't legal advice and doesn't create an attorney-client relationship. For a determination about your business, consult an attorney licensed in the relevant state.
FAQ
Which states have consumer health data privacy laws?
As of this page's last update: Washington (My Health My Data Act), Nevada (SB 370) and Connecticut (CTDPA as amended by Public Act 23-56). Other states have introduced similar bills — verify current status for any state you operate in.
Is Nevada's SB 370 the same as Washington's My Health My Data Act?
Very similar in substance, different in enforcement. Both require a health-data notice, opt-in consent, a separate sale authorization and ban geofencing. Washington is generally understood to allow consumers to sue directly; Nevada is enforced by the Attorney General.
Does Connecticut have a consumer health data law?
Yes — Connecticut added consumer health data protections to the CTDPA rather than passing a standalone act. It applies once you meet the CTDPA's applicability thresholds, and it's enforced by the Attorney General.
If I comply with Washington, am I compliant in Nevada and Connecticut?
Not automatically, but you're most of the way there. Washington is broadly the strictest of the three, so it's a strong baseline — each state still has its own definitions and notice mechanics that counsel should confirm.
Does this generator produce Nevada or Connecticut documents?
Not today — it generates Washington (RCW 19.373) documents only, and says so at checkout. Because the three laws share a structure, many businesses use the Washington pack as a baseline and have counsel adapt it.
Do these state laws apply if my business isn't located in that state?
Generally yes — they follow the consumer, not your office. Collecting health data from a Washington resident can put you in scope even with no Washington presence. See WMHMDA outside Washington.