Washington's My Health My Data Act, signed in April 2023, required most regulated entities to comply with its core obligations by March 31, 2024, and small businesses by June 30, 2024. It covers a broad range of consumer health data, requires consent to collect and share it, requires a consumer health data privacy policy, bans certain geofencing around health care facilities and can be enforced through Washington's Consumer Protection Act. Functional medicine practices that collect wellness data online needed to review forms, tracking and marketing. This is marketing guidance, not legal advice.
Functional medicine marketing runs on health information. Intake quizzes ask about energy, digestion, sleep and hormones. Lead magnets ask visitors to share symptoms in exchange for a guide. Ad audiences are built around people who visited pages about gut health or thyroid testing. For years, much of that data sat in a gray area, outside the hospital world that most people associate with health privacy.
In 2024, Washington State narrowed that gray area. Its My Health My Data Act, signed in April 2023, required most regulated entities to comply with its core obligations by March 31, 2024, and small businesses by June 30, 2024. It applied to a broad category of consumer health data, including data handled by businesses that are not covered by HIPAA.
This retrospective explains what the law did, why it mattered for functional medicine and wellness practices, and how to handle health data in marketing today. This is marketing guidance, not legal advice. For our broader approach, see functional medicine marketing.
What actually happened in 2024
The law. The Washington Attorney General’s office describes the My Health My Data Act as a law protecting personal health data that falls outside HIPAA. It was signed in April 2023, and its main obligations applied from March 31, 2024 for most regulated entities and June 30, 2024 for small businesses.
Broad definitions. The law’s definition of consumer health data, set out in chapter 19.373 RCW, covers personal information linked or reasonably linkable to a consumer that identifies their past, present or future physical or mental health status. That can include information about health conditions, symptoms, treatments, measurements, biometric and genetic data, and certain data inferred from other information.
Consent and policy. Regulated entities must obtain consent to collect consumer health data, except as necessary to provide a requested product or service, and separate consent to share it. They must publish a consumer health data privacy policy and link to it prominently. Selling consumer health data requires a signed, detailed authorization.
Consumer rights. Consumers gained rights to confirm whether their health data is collected, shared or sold, to access it, to withdraw consent and to request deletion.
Geofencing. The law bans geofences around in-person health care services when they are used to identify or track consumers, collect consumer health data or send health-related notifications, messages or ads. That provision took effect earlier, in July 2023.
Enforcement. Violations are treated as violations of Washington’s Consumer Protection Act. The Attorney General can enforce it, and the law also allows private lawsuits.
Why it mattered for functional medicine
Functional medicine practices often collect more health detail in their marketing than many other specialties. A symptom quiz might ask about fatigue, digestion, mood or weight. A webinar signup might ask about a diagnosis. A newsletter might segment subscribers by condition. Those are the kinds of data the Washington law was written to protect.
Many of those tools live outside a practice’s clinical systems. They run on form builders, email platforms, quiz apps and ad pixels. Even practices that were careful with medical records sometimes had little visibility into where marketing data went once a visitor submitted a form.
The law also showed a trend. In the same year, federal regulators and courts were debating how far HIPAA reached into website tracking, as covered in our retrospective on the 2024 tracking ruling. States were moving to fill gaps, and Washington’s approach was among the broadest. A practice that waited for one clear national rule risked falling behind.
What typical agencies did
Many agencies kept running the same playbook: symptom quizzes connected to email automations, pixels on every page and audiences built from health-related browsing. Some did not realize the law existed. Others assumed it only applied to apps or large tech companies.
A common shortcut was adding a line to the privacy policy and calling it done. The law asks for more than a sentence. It asks for consent before collection and separate consent before sharing, a dedicated health data policy, and processes to answer consumer requests.
Very few agencies mapped where health data actually flowed from a practice’s marketing stack, which is the first step toward handling it responsibly.
What it means for a functional medicine practice today
Responsible data handling can coexist with strong marketing. Here is how we approach it, alongside qualified legal advice.
1. Map every place health data enters
List every form, quiz, chat tool, booking flow and email signup, and note what each one asks. You cannot protect data you have not found.
2. Collect less in marketing
Ask for the minimum needed to respond. Save detailed health history for the clinical intake in your secure systems, not a marketing form.
3. Get consent before collecting
Where health data is needed, explain what you collect and why, and get clear consent before collection, with separate consent before any sharing.
4. Review tracking on sensitive pages
Check which pixels and tags run on condition, service and booking pages, and what they send. Remove or restrict anything that could share health information.
5. Publish a clear health data policy
Work with counsel on a consumer health data privacy policy where required, link it prominently and make sure your team can handle access and deletion requests.
6. Avoid location targeting near facilities
Do not use geofencing around health care locations to track people or serve health ads. Choose broader, privacy-respecting targeting instead.
The problem with symptom quizzes
Symptom quizzes became a favorite lead magnet in functional medicine because they work. Visitors enjoy them, they feel personal and they produce detailed leads. But a quiz that asks about digestive symptoms, mood or hormone issues is collecting health information by design, and the answers often flow into email platforms, ad tools and spreadsheets.
That does not mean quizzes are off limits. It means they need to be built carefully. Ask only what is needed to give a useful result, explain how answers are used, get consent before collecting them and keep the data out of advertising tools. In many cases, a quiz can deliver its value without storing detailed answers at all, simply by recommending an educational page or a consultation.
The same thinking applies to downloadable guides, webinars and challenge programs. Each one is a data collection point. Each one should be reviewed with the question: do we need this information, and do we handle it in a way a patient would expect?
Trust is part of the offer
Functional medicine patients often arrive after frustrating experiences elsewhere. They are sharing personal details about symptoms that have affected their lives for years. When a practice treats that information carefully, it reinforces the reason patients chose functional medicine in the first place: to be listened to and treated as a whole person.
Clear privacy practices can be part of the marketing message. A short, plain explanation near a form that says what the practice collects, why and who sees it builds confidence. A booking flow that moves sensitive questions into a secure intake shows professionalism. Patients notice these details, especially high-value patients who are comparing several practices.
The reverse is also true. A patient who starts seeing ads about a sensitive condition after visiting a practice’s website may feel watched. That feeling can undo months of trust building.
Why practices outside Washington paid attention
Many functional medicine practices serve patients across state lines through telehealth, online programs or supplement sales. A practice located elsewhere may still collect data from Washington residents. Whether the law applies depends on the facts, and that question belongs with qualified counsel.
Beyond Washington, other states passed health data and privacy laws around the same time, including Nevada and Connecticut, and broader state privacy laws continued to spread, such as the Texas privacy act that took effect in July 2024. Browser and tracking changes added pressure too, as covered in our tracking retrospective. Building one careful standard for health data across the whole practice is usually simpler than managing different rules for each state.
That approach also prepares a practice for the next law. When data collection is minimal, consent is clear and tracking is controlled, new requirements are easier to meet.
Working with your vendors
Most marketing data flows through vendors: form builders, quiz platforms, email systems, chat tools, booking software and analytics. Each vendor has its own data practices, and some use data for their own purposes. A practice that wants to handle health data responsibly needs to know which vendors receive it and on what terms.
Ask vendors how they store and use the data you send them, whether they share it, and what agreements they offer for sensitive information. Where a vendor cannot meet your standards for health data, move that part of the process to a system that can. This review is rarely exciting, but it is where most real risk sits.
A simple data review for your team
A practical review can be done in an afternoon. Open each form and quiz on your website and list every question it asks. Next to each one, write why you need it and where the answer goes. Then open your tag manager or site settings and list every tracking tool that runs on those pages. Anything without a clear purpose is a candidate for removal.
Share the results with your clinical lead and your counsel. Decide together which questions move into secure intake, which disappear and which stay with clear consent. Repeat the review whenever a new campaign, quiz or tool is added, so the practice does not drift back into collecting more than it needs.
What 2024 does not tell us
The law took effect in 2024, so there was little public enforcement history to show how regulators and courts would interpret its broad definitions. We do not have reliable data on how many practices changed their marketing in response or how many consumers used their new rights. Interpretations can change, and later amendments or cases may affect how the law applies. What 2024 does show is that health data in marketing became a clear legal risk, not just an ethical question.
The premium practice advantage
A premium functional medicine practice earns trust before the first appointment. Thoughtful data handling, honest forms and respectful marketing are part of that experience, and they reduce risk at the same time.
That is how we build marketing for practices like yours: websites and intake flows designed to collect only what is needed and to keep sensitive data out of ad tools. See our services and who we help, including functional medicine practices. Our team works from Austin with practices nationwide.
The bottom line
Washington’s My Health My Data Act brought broad health data protections into force in 2024, reaching wellness and marketing data outside HIPAA. Functional medicine practices that collect symptoms and health details online should map their data, collect less, get consent and control tracking, with qualified legal advice. This is marketing guidance, not legal advice.
Check if your market is open. We take one practice per specialty per market. Request a market check or call (716) 400-0084.
Frequently asked questions
What is Washington's My Health My Data Act?
It is a Washington state law that protects consumer health data. It requires regulated entities to get consent to collect and share that data, publish a consumer health data privacy policy, honor consumer rights such as access and deletion, and avoid certain geofencing around in-person health care services.
When did it take effect?
The Washington Attorney General's office says most regulated entities had to comply with the core sections by March 31, 2024, and small businesses by June 30, 2024. The geofencing prohibition took effect earlier, in July 2023.
Does it only apply to HIPAA-covered providers?
No. One reason it drew attention is that it reaches consumer health data handled outside HIPAA, such as data collected by apps, websites and wellness businesses. Information already protected under HIPAA is treated differently, so practices should get qualified advice on how it applies to them.
What counts as consumer health data?
The law defines it broadly, including information that identifies a consumer's past, present or future physical or mental health status. That can include data about symptoms, health conditions, treatments, biometric data and some information inferred from other data.
How is it enforced?
Violations are treated as violations of Washington's Consumer Protection Act. The Attorney General can enforce it, and the law also allows private lawsuits, which raised the stakes for businesses that collect health data.
Does a practice outside Washington need to care?
Possibly. The law can reach entities that do business in Washington or target products or services to Washington consumers. A practice that markets nationally or offers telehealth should ask qualified counsel. This is marketing guidance, not legal advice.