What Washington’s My Health My Data Act Means for Seattle-Area Medical Practices

If your practice’s compliance plan starts and ends with HIPAA, there’s a law sitting next to it that doesn’t care whether you’re a “covered entity.”

Washington’s My Health My Data Act, codified as Chapter 19.373 RCW, took effect for most regulated entities in March 2024 and extended to small businesses by June 30, 2024. It’s a state consumer-privacy law, not a healthcare regulation, and that distinction is exactly why it catches practices that assume HIPAA already has them covered.

It Covers More Than HIPAA Does

HIPAA applies to specific entities handling specific kinds of clinical records. My Health My Data Act applies to a much broader category called “consumer health data,” which includes anything a business could reasonably link to a consumer’s physical or mental health. That reaches well past chart notes.

Intake forms on your website. Appointment scheduling tools. Patient portal login activity, ideally running through secure patient communications rather than whatever came bundled with the practice management software. A wellness questionnaire a new patient fills out before their first cardiology consult. Data your practice management software shares with a marketing platform to send appointment reminders. If any of that data can be tied to a specific person’s health, it likely falls under this law, regardless of whether HIPAA would ever touch it.

For a cardiology, surgical, or OB-GYN practice, that means the exposure isn’t confined to the EHR. It extends to the website, the scheduling widget, and whatever marketing or analytics tools are quietly running in the background.

The Requirements, in Plain Terms

The law asks for a few concrete things, not vague good intentions:

A published health data privacy policy. One that actually describes what consumer health data you collect, why, and whether any of it is shared or sold.

Data minimization. Collect and retain only what you need to provide the service requested, or get explicit consent for anything beyond that.

A real security program. Administrative and technical safeguards appropriate to the type and volume of health data a practice actually handles.

Consumer rights, honored on request. The ability for a patient to confirm what you have on them, access it, delete it, and withdraw consent for it to be shared.

The Geofencing Rule Almost Nobody Knows About

Here’s the detail that catches practices off guard. Washington law makes it unlawful to implement a geofence, a virtual boundary using GPS, cell tower, or Wi-Fi data, within 2,000 feet of any location that provides in-person health care services, if that geofence is used to track people or to send them health-related messages or ads.

This provision was written with reproductive health clinics in mind, in the wake of the Supreme Court’s Dobbs v. Jackson Women’s Health Organization decision. But the statute isn’t limited to reproductive health facilities. It applies to any entity providing in-person health care services, which includes a cardiology practice, a surgical center, or an OB-GYN office.

That matters because a lot of practices don’t run their own digital marketing. A vendor does. And if that vendor is running geofenced ads or location-based retargeting anywhere near your facility to reach past or prospective patients, your practice can be exposed to a violation you didn’t know was happening, from a decision you didn’t make yourself.

The Enforcement Risk Is Real, Not Theoretical

Unlike HIPAA, which is enforced by federal regulators, the My Health My Data Act gives individual patients a private right of action, a point the Attorney General’s office makes explicit for consumers. A violation is treated as an unfair or deceptive trade practice, and a patient who brings a claim can recover actual damages, attorneys’ fees, and up to treble damages.

That’s a meaningfully different risk profile than a HIPAA compliance gap that might surface during an audit years from now. This is a law any patient can act on directly.

What This Actually Means for Your Practice

Being HIPAA compliant is still necessary. It just isn’t sufficient anymore, not in Washington. A technology assessment is usually the fastest way to find out where the gaps are. The practical starting point looks like this:

• Audit every vendor touching patient-adjacent data: scheduling software, marketing platforms, website analytics, patient portals, and anything collecting information before a patient is officially a patient in the clinical sense.
• Ask any marketing vendor directly whether geofencing or location-based targeting is part of their strategy near your facility.
• Publish a health data privacy policy that reflects what your practice actually does, not a generic template.
• Put real technical safeguards behind the data: encryption, access controls, and a documented security program sized to what you actually collect.

This is exactly the kind of compliance-driven IT strategy work, instead of bolting compliance on after an audit flags a gap. A practice can have a compliant-sounding policy on paper and still be exposed, because the exposure often lives in a vendor contract or a tracking script nobody in the office has ever looked at.

Zen Techworks works with Seattle-area medical practices to find exactly those gaps: the vendor a practice forgot was collecting data, the tracking pixel nobody remembered adding, and a backup plan that wouldn’t actually hold up under this law’s security requirements. Schedule a free IT assessment to see where your practice actually stands.