Governance, risk & compliance
Consumer health data laws: Washington, Nevada and Connecticut RCW 19.373 (2023 c 191); NRS 603A.400-.550; CT AG page
Three state laws regulate consumer health data held outside HIPAA, and they reach far past clinics: a shoe retailer’s fitness app or an online pharmacy ad network can be covered.
Washington’s My Health My Data Act (RCW ch. 19.
373, 2023 c 191, ss. 19.
373. 005 to 19.
373. 100) applies to regulated entities from 31 March 2024 and small businesses from 30 June 2024 (a small business collects or processes consumer health data of fewer than 100,000 consumers in a calendar year, or earns under 50 percent of gross revenue from it and handles data of fewer than 25,000 consumers).
It requires a consumer health data privacy policy linked on the homepage (. 020), separate consent to collect and to share (.
030), access, withdrawal and deletion rights with a 45-day response, one 45-day extension and a 45-day appeal (. 040), deletion from backups within six months, restricted access and reasonable security (.
050), binding processor contracts (. 060), a signed authorization to sell that expires after one year and is kept six years (.
070), and a ban on geofences around in-person health care providers (. 080).
A violation is an unfair or deceptive act under the Consumer Protection Act (. 090).
The chapter does not say in so many words that a consumer may sue; that route runs through RCW 19. 86.
090, and how courts treat it was not verified here. Exemptions in .
100 include HIPAA protected health information and several other regimes. Nevada’s SB 370 (2023) added NRS 603A.
400 to 603A. 550, effective 31 March 2024: a similar structure, a 30-day deletion rule with backup delay of up to two years, a one-year sale authorization with copies kept at least six years after it expires, and a 1,750-foot geofence limit; 603A.
550 treats a violation as a deceptive trade practice and states that the sections do not create a private right of action; 603A. 490 exempts HIPAA entities, GLBA entities, 42 CFR Part 2 programs and holders of gaming licences, among others.
Connecticut’s provisions sit in the Connecticut Data Privacy Act (Conn. Gen.
Stat. 42-515 and following, effective 1 July 2023): per the Attorney General’s page they apply with no revenue or volume threshold, the nonprofit exemption does not apply, and they require a confidentiality duty for staff and contractors, a written processor contract, no sale without consent and no geofence at mental or reproductive health facilities; the Attorney General has exclusive enforcement (no private right of action), with penalties of up to $5,000 per violation under the Connecticut Unfair Trade Practices Act.
The Connecticut codified section number, its Public Act number and the 2025 amendments were NOT read and are not asserted. Other states may regulate health data inside broader privacy laws; they are not covered here.
A section applies these duties to AI tools (a chatbot or analytics service that receives health data is processing it); no AI-specific health data statute was reviewed. General information, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses Consumer health data laws: Washington, Nevada and Connecticut at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Regulated entity | An organization that does business in the state or targets its residents and decides why and how consumer health data is processed. Owns the policy, consent, rights, security, sale authorization and geofence duties. In Washington the duties began 31 March 2024; Nevada’s sections took effect 31 March 2024; Connecticut’s sit in the Data Privacy Act, effective 1 July 2023 (the start date of the health provisions themselves was not read). | — |
| Small business (WA) | A Washington regulated entity under RCW 19.373.010(28): fewer than 100,000 consumers in a calendar year, or under 50 percent of gross revenue from consumer health data and fewer than 25,000 consumers. It has the same duties with a later start (30 June 2024). Nevada and Connecticut do not use this label in the sources read. | — |
| Processor | A service provider that processes consumer health data for a regulated entity. Must follow a binding contract and written instructions, help the regulated entity meet its duties and honour deletion notices. If it goes beyond its instructions it is treated as a regulated entity for that data (RCW 19.373.060(1)(c)). | — |
How Lavawall® helps you get to Consumer health data laws: Washington, Nevada and Connecticut compliance
Most of Consumer health data laws: Washington, Nevada and Connecticut comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Consumer health data laws: Washington, Nevada and Connecticut, and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against Consumer health data laws: Washington, Nevada and Connecticut in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports Consumer health data laws: Washington, Nevada and Connecticut as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- Consumer health data laws: Washington, Nevada and Connecticut RCW 19.373 (2023 c 191); NRS 603A.400-.550; CT AG page
- Category
- Privacy
- Region
- USA
- Levels
- 3 assessment tiers
All United States frameworks and training →
Map this framework freeTalk to our team