HIPAA depends on the organization's role and whether data is held in a covered entity or business associate relationship, while Washington's My Health My Data Act depends on whether information is consumer health data linked or reasonably linkable to a Washington consumer. A Washington founder with a wellness app in testing, a retailer selling supplements online, or a platform adding symptom search frequently faces the same late night question. The product isn't a hospital, no clinician touches the data, and yet an investor, customer, or vendor asks for a HIPAA answer before signing. That moment is where mistakes start, because a no under HIPAA doesn't end the analysis in Washington. Both tests have to run, dataset by dataset, and the answer can differ by field, partner, and use.
Why Two Health Privacy Laws Can Cover the Same Dataset
Most founders learn one name first. HIPAA is the federal law associated with doctors, insurers, and medical records, so teams search for how to determine if their data falls under HIPAA or MHMD in Washington state expecting a single yes or no. The laws don't work as alternatives. HIPAA follows certain health care organizations and their service providers. MHMD follows consumer health information in Washington commerce, including information HIPAA never reaches.
The Washington Attorney General describes MHMD as the first U.S. privacy focused law protecting personal health data outside HIPAA's scope. That design explains the overlap. A clinic's patient portal can sit inside HIPAA, a standalone period tracker can sit inside MHMD, and a vendor serving the clinic while also selling a direct to consumer app can face both regimes for different data flows, sometimes for closely related fields.
The Two Questions That Start Every Review
First, what's the organization's role for this dataset? A covered entity, a business associate, a consumer facing business with no covered customer, or several roles at once can lead to different outcomes. Second, what's in the data and who can it be linked to? Symptoms, medication purchases, fertility signals, and clinic location can be health related even without a diagnosis code.
Practical rule: Never classify a company once and stop. Classify each dataset in its actual relationship, system, and use.
Stakes aren't theoretical. The U.S. Department of Health and Human Services oversees HIPAA, while Washington's Attorney General plays a central role for MHMD. Customers also run their own diligence, asking for contracts, notices, and evidence that classification wasn't guessed. A reusable decision matrix helps a team answer consistently as features change. Structured data privacy and compliance review starts with that role and data mapping, before templates or policy language enter the picture. Recent state level debate elsewhere, including New York's vetoed health privacy proposal in December 2025, also shows why Washington's enacted model remains the reference point founders can't treat as a passing trend.
What HIPAA Actually Covers and When It Does Not
HIPAA doesn't regulate every fact about health. Coverage starts with three categories of covered entities, then extends through service relationships. Sensitivity alone doesn't trigger the federal Privacy Rule.
The Covered Entity Test
- Health plans: Insurers and similar plans that pay for care fall in this category.
- Health care clearinghouses: Entities that process health information into standard or nonstandard formats between parties fall here.
- Health care providers: Doctors, clinics, and hospitals count when they transmit health information electronically for transactions with standards adopted by the U.S. Department of Health and Human Services, such as insurance billing.
A provider that never conducts those standard electronic transactions presents a different HIPAA question than a hospital billing electronically every day. That's counterintuitive, but it's how the federal definition is built.
The Business Associate Test
A separate business becomes a business associate when it creates, receives, maintains, or transmits protected health information for a covered entity, as explained in HHS guidance on the HIPAA Privacy Rule and business associate functions. Billing companies, claims processors, data analysis firms, cloud providers, consultants, and law firms can all enter through this door. Written business associate agreements are generally required for those engagements.
Does HIPAA apply to a standalone wellness app? Not merely because the app records sleep, symptoms, or workouts. Without a covered entity or business associate relationship, HIPAA may not apply. If a hospital hires that same app company to handle patient information, the relationship changes and HIPAA obligations can attach to that work.
Protected health information, or PHI, is individually identifiable information about past, present, or future physical or mental health, provision of care, or payment for care, held in that covered context. It includes electronic, paper, and oral forms. Intake forms in a filing cabinet and details discussed on a support call can't be ignored because a database review looked clean. Teams evaluating whether identifiers can be removed from a dataset also benefit from reviewing de-identification best practices, because labels such as anonymized don't decide the legal result by themselves.
How MHMD Reaches Beyond HIPAA
MHMD starts where many HIPAA reviews stop. It generally applies to persons and businesses conducting business in Washington, or providing products or services targeted to Washington consumers, that collect, process, share, or sell consumer health data, subject to statutory exceptions. No hospital customer is required. No billing transaction is required.
What Counts as Consumer Health Data
The definition covers personal information linked or reasonably linkable to a consumer that identifies physical or mental health status. Examples reach conditions, treatment, diagnosis, behavioral or psychological interventions, procedures, bodily functions, vital signs, symptoms, measurements, gender affirming care information, and use or purchase of prescribed medication. A search for a symptom tied to an account, a wearable stream tied to a device, or a purchase history tied to a shopper can therefore matter even when no medical record exists.
Does MHMD apply only to health companies? No. A Washington facing app, website, advertising platform, wearable data service, retailer, or wellness company can be in scope when its data meets the definition. The business category matters less than the Washington nexus and the nature of the information.
Timing and Small Business Thresholds
Compliance phased in earlier than many teams assume. The sale authorization provision began July 23, 2023, larger regulated entities faced core sections beginning March 31, 2024, and small businesses received until June 30, 2024, as summarized by the Attorney General source cited earlier. A founder in 2026 isn't preparing for a future start date. The operative question is whether current practices already match duties that have been phased in.
Small business status also uses numbers, not headcount impressions. The definition covers handling consumer health data of fewer than 100,000 consumers in a calendar year, or deriving less than 50% of gross revenue from collecting, processing, selling, or sharing that data while handling data of fewer than 25,000 consumers. Those thresholds affect classification and timing history, but they don't give a small Washington startup a general pass. Product, marketing, and analytics teams need the count and revenue analysis documented, because a growing user base can move the business across a line without any change in mission.
Side-by-Side How HIPAA and MHMD Treat the Same Data
A direct comparison prevents a common error, treating medical sensitivity as the only trigger. Consider one fact pattern. A Seattle startup runs a symptom checker website. Washington visitors enter headaches, sleep problems, and medication questions. The site stores account emails, cookie IDs, search logs, and purchases of related products, then shares segments with an advertising partner. No clinic is a customer.
Under HIPAA, that dataset likely sits outside coverage because the startup isn't a health plan, clearinghouse, qualifying provider, or business associate for this activity. Under MHMD, the same logs can be consumer health data because they're linkable to Washington consumers and reveal symptoms or medication interests. The data didn't change. The legal lens did.
HIPAA vs MHMD at a Glance
| Trigger | HIPAA | MHMD |
|---|---|---|
| Who is regulated | Covered entities and their business associates | Businesses in Washington or targeting Washington consumers that handle consumer health data |
| What data counts | PHI held in a covered relationship | Personal information linked or reasonably linkable to health status |
| Where it reaches | Federal, tied to covered functions | Washington consumers and Washington conduct |
| Typical trigger | Electronic billing, treatment records, vendor handling PHI | Apps, websites, wearables, purchases, searches, location, inference |
| Core documents | Business associate agreements and HIPAA safeguards | Consumer health data notices, consent, and sale authorization controls |
Can HIPAA and MHMD apply at the same time? Yes, for different datasets or layered obligations within one company. A platform might handle PHI for a clinic under a business associate agreement while also collecting direct to consumer wellness data from Washington users. Segregation matters. Contracts, access controls, notices, and consent flows built for one side shouldn't be assumed to satisfy the other.
A no under HIPAA is only half an answer in Washington. The MHMD test still has to run on the same fields.
The practical divergence shows up in marketing. HIPAA analysis for the symptom checker ends quickly without a covered relationship. MHMD analysis gets more detailed, asking about consent, sharing, sale, targeted advertising, geofencing, retention, and deletion rights. That's why MHMD often functions as the backstop founders miss. It catches the consumer data economy around health, not only the institutional system that delivers care.
A Field-Level Decision Matrix for Any Dataset
Company level labels hide risk. A field level matrix exposes it while decisions can still be changed. The workbook can live in a spreadsheet, but each row needs enough detail for another person to repeat the conclusion months later.
Step One Inventory the Actual Flow
For every dataset, record source, recipient, system, purpose, identifiers, and contractual role. Source might be a user form, wearable, hospital feed, retailer checkout, or support call. Recipient might be an internal data warehouse, cloud host, analytics vendor, advertiser, or clinic. Purpose should state the actual use, such as account service, product improvement, billing, targeted advertising, or sale of insights. Vague entries such as analytics won't support a defensible review. Founders learning what data classification means in practice can use that discipline to keep product names from masking sensitive fields.
Step Two Mark Four Questions for Each Field
- Health related: Does the field identify a condition, symptom, treatment, medication, measurement, care seeking behavior, or mental health status?
- Identifiable or linkable: Can it be tied to a person through a name, account, email, cookie ID, IP address, device identifier, or combination?
- Washington sourced: Was it collected from a Washington consumer, or through a service targeted to Washington?
- Covered activity: Is it collected, processed, shared, sold, used for targeted advertising, or connected to geofencing?
The statute expressly includes data associated with persistent identifiers such as cookie IDs, IP addresses, and device identifiers, while excluding publicly available and deidentified data from personal information, under Washington's codified MHMD definitions in RCW 19.373. Removing a name while keeping a stable device ID therefore doesn't end the inquiry. Deidentification has to eliminate the reasonable ability to associate information with a consumer.
Step Three Record Both Legal Outcomes
Each row should end with a HIPAA result, an MHMD result, the reason, the owner, and the next control. A row for hospital discharge notes sent to a billing vendor points toward PHI and a business associate agreement. A row for cookie linked fertility searches sent to an ad network points away from HIPAA in a standalone model, but toward MHMD consent, sharing, and sale analysis. Documented disagreement is useful too. It shows where counsel review is needed before launch, not after a customer questionnaire arrives.
Why Non-Health Data Can Still Trigger MHMD Exposure
The riskiest sentence in a product meeting sounds reasonable. A team says the company only has behavioral or location data, not health data. MHMD doesn't reward that shortcut when combinations reveal health status.
Washington's health care privacy toolkit states that MHMD applies to businesses and data collected in Washington, including sensitive location related information outside HIPAA's scope. Location that may reveal access to health care services deserves special attention. Repeated visits near a clinic, pharmacy pickups, or travel patterns tied to a device can communicate more than a neutral map pin suggests.
Inference Is the Blind Spot
Browsing, purchases, searches, app usage, and geolocation can combine into an inference about pregnancy, treatment, mental health status, or a clinic visit. An advertising segment labeled interested in fertility support, a risk score generated by a model, or telemetry showing nightly use of a symptom tool can become health revealing output. The input fields might look ordinary in isolation. The output tells a different story.
Does an algorithm create consumer health data? It can, when a derived score, audience segment, or model output identifies health status and remains reasonably linkable to a Washington consumer. Classification can't stop at raw inputs. Teams need to map outputs, recipients, and retention as well.
An inference focused assessment asks four concrete things. What signals enter the system, what health conclusion can be drawn, who receives that conclusion, and can the recipient link it back to a person or device? Geofencing around care locations, targeted ads based on inferred conditions, and sale of segments require separate review. Consent language buried in a general privacy policy shouldn't be assumed to solve those uses. Guidance on data management practices under My Health My Data helps translate that assessment into collection limits and partner controls. Retailers, employer facing platforms, ad technology providers, and AI products all belong in this review when Washington data can reveal care seeking or health status.
Worked Example Tracing a Fertility Dataset Through Both Tests
A fictional Washington startup, Cascade Cycle, sells a fertility tracking app directly to consumers. Users log cycle dates, symptoms, basal temperature, and pregnancy test results. The app records device IDs, approximate location, in app searches for clinics, and purchases of prescribed medication through a partner link. Cascade then sells audience insights to advertisers and describes the package as anonymized because names and emails are removed.
HIPAA Test
Cascade isn't a health plan, clearinghouse, or provider conducting standard electronic transactions for this consumer product. No hospital, insurer, or clinic has engaged Cascade to handle patient information. On those facts, HIPAA likely doesn't apply to the standalone app dataset. The conclusion would change for a separate clinic integration where Cascade receives patient information as a service provider.
MHMD Test
Cycle records, symptoms, temperature measurements, pregnancy test results, fertility searches, and medication purchases identify health status. Device IDs keep the records linkable, and location connected to clinic searches can reveal care seeking. Washington users are targeted, and insights are sold for advertising. Removing names doesn't cure linkability when persistent identifiers and detailed health patterns remain.
| Field | HIPAA Result | MHMD Result |
|---|---|---|
| Cycle and symptom logs | Outside on standalone facts | Consumer health data |
| Device ID | Identifier only in a covered context | Preserves linkability |
| Clinic search location | Outside on standalone facts | Sensitive health revealing signal |
| Advertiser segment | Outside on standalone facts | Sale and targeted advertising review required |
Corrective work starts before another campaign ships. Cascade needs a consumer health data privacy notice matched to actual practices, consent aligned to collection and sharing, valid authorization analysis for sale, geofencing review, vendor restrictions, and deletion workflows. The decision trail should show each field, each recipient, and why the advertiser output was or wasn’t deidentified. That record gives outside counsel something concrete to test, rather than a marketing claim about anonymity.
Your 2026 Action Plan for HIPAA and MHMD Compliance
A thirty day sprint can produce a usable first pass. Week one inventories datasets, systems, vendors, and Washington data sources. Week two maps covered entity and business associate relationships, then runs the field level matrix for consumer health data, inference, and location. Week three reviews notices, consent flows, sale practices, geofencing, targeted advertising, retention, and deletion. Week four closes contract gaps and documents unresolved calls.
Vendor paperwork deserves its own check, especially where a data processing agreement must reflect actual sharing rather than generic processor language. Consumer facing health products also benefit from plain language resources that help households secure your home health data, because user trust drops when app practices feel hidden. By Design Law Firm & Legal Consultancy, PLLC offers Washington specific MHMD and HIPAA counsel, including data flow review, notice assessment, privacy program development, and vendor agreement analysis. Escalation to counsel is warranted when a vendor touches hospital or insurer data, a wellness product targets Washington, or location and inference may reveal health information. Amendments, Attorney General guidance, and court interpretation will keep moving the practical line on reasonable linkability, so classification needs a review date, not a one time stamp.
Founders facing a HIPAA or MHMD classification question can get a dataset by dataset review of covered entity status, business associate contracts, consumer health data notices, consent flows, and vendor sharing before a launch or diligence deadline forces rushed answers. By Design Law Firm & Legal Consultancy, PLLC helps Washington technology and health adjacent businesses turn that analysis into documented, practical compliance steps. Contact our law office at (206) 593-1519.
