Compliance clarity · Updated 2026
WMHMDA vs HIPAA: Why Your App or Business Probably Isn't Covered by HIPAA — And What Is
If you've ever thought "we're fine, we're HIPAA compliant" or "HIPAA doesn't apply to us, so we don't need to worry about health data law," you're not alone — and you may be exposed either way. This is the single most common misunderstanding we see among founders, marketers, and product teams handling health-adjacent data, and it's exactly the gap the Washington My Health My Data Act (WMHMDA) was written to close.
In short: HIPAA only covers health plans, providers, clearinghouses, and their business associates. WMHMDA covers any business — regardless of type or size — that collects "consumer health data" from Washington residents. Most consumer apps and wellness brands sit outside HIPAA but squarely inside WMHMDA. See the full comparison table below, or generate your documents.
Read the full comparison
HIPAA and WMHMDA answer two completely different questions
HIPAA (the Health Insurance Portability and Accountability Act) asks: "Who are you?" It only regulates "covered entities" — health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with certain transactions — plus their "business associates" who process data on their behalf under a signed Business Associate Agreement.
WMHMDA (RCW 19.373) asks a completely different question: "What data do you have?" It doesn't care whether you're a hospital, a two-person startup, a wellness influencer's e-commerce store, or a Fortune 500 tech company. If you determine the purpose and means of processing "consumer health data" belonging to a Washington resident, the law applies to you — full stop, no entity-type test, no revenue threshold, no employee-count threshold.
Who HIPAA actually covers (it's a much shorter list than people assume)
- Health plans (insurers, HMOs, Medicare/Medicaid programs)
- Health care clearinghouses
- Health care providers who conduct certain transactions electronically (doctors, hospitals, dentists, pharmacies, etc.)
- Business associates who create, receive, maintain, or transmit protected health information (PHI) on behalf of one of the above, under a signed contract
Notice what's not on that list: consumer fitness apps, meditation and mental-wellness apps, period- and fertility-tracking apps, direct-to-consumer supplement and wellness brands, telehealth-adjacent marketing sites that don't provide care themselves, wearable device makers, and most health and wellness SaaS products that sell straight to consumers rather than through a covered health care provider. None of these are "covered entities," and most are not business associates of one either — which means the data they collect, however sensitive, typically sits entirely outside HIPAA's reach.
What WMHMDA covers instead: the data itself, not your business type
WMHMDA defines "consumer health data" broadly as personal information that is linked or reasonably linkable to a consumer and that identifies their past, present, or future physical or mental health status — including inferences drawn from other data that reveal health status. That sweeps in categories most businesses never think of as "medical," such as:
- Fitness and activity tracking (steps, workouts, heart rate zones)
- Sleep data
- Nutrition, diet, and calorie-tracking data
- Reproductive or sexual health data, including menstrual cycle tracking
- Mental health and mood-tracking data
- Medication reminders and adherence data
- Biometric data (heart rate, gait, fingerprints)
- Precise location data that could reveal an attempt to receive health care services
This is exactly why a step-counter app, a period tracker, or a supplement subscription business can be squarely inside WMHMDA's scope while sitting entirely outside HIPAA's.
A side-by-side comparison
| HIPAA | WMHMDA (RCW 19.373) | |
|---|---|---|
| Jurisdiction | Federal, US-wide | Washington State, but reaches any business processing WA residents' data |
| Who it covers | Covered entities + business associates only | Any entity/person that determines purpose & means of processing consumer health data |
| Small business exemption | N/A (entity-type test) | None — no revenue or headcount threshold |
| Core trigger | Type of organization | Type of data collected |
| Consent model | Permitted uses without consent for treatment/payment/operations | Opt-in, unambiguous consent required for collection and again for sharing |
| Sale of data | Restricted, with authorization in narrow cases | Requires a specific, signed, expiring authorization before any sale |
| Private lawsuits | No private right of action | Yes — consumers can sue directly, damages up to $25,000/violation + attorney fees |
"We're HIPAA compliant" is not a defense to a WMHMDA claim
Because the two laws test completely different things, being HIPAA compliant (or correctly determining HIPAA doesn't apply to you) tells you nothing about your WMHMDA obligations. We regularly see three variations of this mistake:
- "We're not a covered entity, so no health-data law applies to us." Wrong — WMHMDA doesn't use the covered-entity test at all.
- "We have a HIPAA-style Notice of Privacy Practices, so we're covered." A Notice of Privacy Practices does not satisfy WMHMDA's specific required disclosures under RCW 19.373 — categories collected, sources, purposes, third-party sharing, and the consumer rights described below.
- "Our data isn't 'medical records,' so it's not health data." WMHMDA's definition is much broader than medical records — see the list above.
What you actually need if HIPAA doesn't apply to you
If you've correctly determined HIPAA doesn't cover your business (true for most consumer apps and wellness brands) but you collect any of the data categories above from Washington residents, you need the five documents WMHMDA effectively requires every regulated business to have on file: a Consumer Health Data Privacy Policy, an Opt-in Consent Form, a Valid Authorization to Sell (or a dated "not applicable" record if you don't sell data), a Data Retention & Disposal Schedule, and a Consumer Rights Request Form. See our full WMHMDA guide and the does WMHMDA apply to me decision guide for the complete picture.
Not a HIPAA-covered entity? You may still need these 5 documents.
Generate your Consumer Health Data Privacy Policy, Opt-in Consent Form, Sale Authorization, Retention Schedule, and Rights Request Form in ~2 minutes. Read everything free before you pay — $99.99 one-time.
Generate My Compliance Pack — $99.99FAQ
Does HIPAA cover my fitness app, wellness site, or health-adjacent product?
Almost never. HIPAA only applies to health plans, health care clearinghouses, health care providers, and their business associates. A consumer app or D2C wellness brand is typically none of those.
If HIPAA doesn't apply to me, does that mean I'm compliant with health data rules?
No. If you collect consumer health data from Washington residents, WMHMDA can apply regardless of HIPAA status — it uses a completely different test.
Is WMHMDA basically the same law as HIPAA?
No. HIPAA is a federal law limited to covered entities and business associates. WMHMDA is a Washington State law that applies based on the type of data collected, not the type of organization.
What's the difference between wmhmda and hippa (hipaa) in simple terms?
HIPAA asks who you are (provider, insurer, clearinghouse, or their vendor). WMHMDA asks what data you have (does it reveal health status). Many businesses fail the HIPAA test and pass straight into WMHMDA's scope.
Is a period tracker or step counter app covered by HIPAA or by WMHMDA?
Typically WMHMDA, not HIPAA. Consumer fitness and menstrual-cycle tracking data are explicitly named as "consumer health data" under RCW 19.373, while the app itself is rarely a HIPAA covered entity.
Do I need a WMHMDA privacy policy if I already have a HIPAA notice of privacy practices?
A HIPAA Notice of Privacy Practices does not satisfy WMHMDA. You need a specific consumer health data privacy policy with WMHMDA's required disclosures.
What is my health my data act washington and how is it different from hipaa compliance?
It's a 2023 Washington State law (RCW 19.373) that regulates "consumer health data" for any business processing it — regardless of HIPAA status, revenue, or headcount.
How is WMHMDA different from CCPA or GDPR?
CCPA and GDPR are general privacy laws that often exempt small businesses below a revenue or volume threshold. WMHMDA has no such threshold and adds health-specific rules — like the geofencing ban and a separate sale-authorization form — plus a private right of action letting consumers sue directly.