Consumer health data
By Gareth HoyleLast updated How we research
Consumer health data is personal information that identifies a person's physical or mental health status, protected under Washington's My Health My Data Act outside HIPAA.
Consumer health data is personal information that is linked or reasonably linkable to a consumer and identifies their past, present or future physical or mental health status, under Washington's My Health My Data Act, RCW 19.373. The Washington Attorney General says it can include inferences, such as health status derived from purchases.
What does the law require before a sale?
RCW 19.373.070 makes it unlawful to sell or offer to sell consumer health data without a valid authorization signed by the consumer. The authorization must name the data, the seller and the purchaser, state the purpose, and expire one year after signing. Both seller and purchaser must keep a copy for six years.
The main provisions applied from March 31, 2024, or June 30, 2024 for small businesses. A violation is a violation of the Washington Consumer Protection Act, and consumers can sue.
Why does this matter for AI training data?
It matters because the law reaches health data outside HIPAA, such as app, retail and wellness records. A license of such data needs signed authorizations from every consumer, so sellers usually exclude it. See sensitive personal information for the wider category.