LexLint

Know the law your code answers to.

Law / United States / Washington

HB 1155, My Health My Data Act

RCW 19.373; HB 1155, chapter 191, Laws of 2023

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 31 March 2024.

A sensitive categories rule binding private bodies.

As of 2 September 2026.

What it requires

  • Obtain separate, affirmative opt-in consent before collecting or sharing a Washington consumer's health data, including any biometric identifier used to infer a health condition, whether captured live or extracted from a stored photo, video, or audio recording.
  • Obtain a further signed authorization before selling consumer health data.
  • Do not geofence within 2,000 feet of a health care facility to identify, track, or send notifications to consumers seeking care.
  • Honor a consumer's request to confirm, access, or delete their consumer health data within 45 days, extendable once by 45 additional days.

If you get it wrong

Criminal exposureNo

Private right of actionYes

Penalty structure

Available to the Washington Attorney General, who may enforce this chapter under the Consumer Protection Act because RCW 19.373.090 deems a violation an unfair or deceptive act under RCW 19.86.020. An injured consumer may separately sue under the Act's own private right of action, RCW 19.86.090.

Rule
Per violation only
As of
2 September 2026
Currency
USD
Per violation unit
Violation
Per violation amount
7,500

Statutory damages

No fixed per-person amount: an injured consumer's private action under RCW 19.86.090 recovers actual damages, court costs, and attorney's fees, and the court may in its discretion increase the damages award up to three times actual damages, with that enhancement capped at $25,000 for a violation of RCW 19.86.020, the provision this Act's violations are deemed to violate.

As of
2 September 2026

Who enforces it

Enforcement body

Washington Attorney General, enforcing this chapter as an unfair or deceptive act under the Consumer Protection Act, RCW 19.86 (injunctive relief under RCW 19.86.080, civil penalties under RCW 19.86.140); an injured consumer may also bring a private civil action under RCW 19.86.090.

What it reaches

Excludes recording-derived identifiersNo

Obligation class

Consent, Data subject rights, Prohibition, Biometric

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Requires a private regulated entity to obtain separate, affirmative opt-in consent before collecting or sharing a Washington consumer's health data, a category that includes biometric data extracted from imagery or voice recordings with no exclusion for a recording-derived identifier, and a further signed authorization before selling it.

Bans geofencing within 2,000 feet of a health care facility to identify, track, or notify consumers seeking care, and grants consumers the right to confirm, access, withdraw consent to, and delete their data within 45 days, extendable once by 45 more days.

When LexLint raises it

  • processes_biometrics
  • processes_voice
  • crawls_web
  • automated_outreach
  • deploys_chatbot

Read the law

official codified statute text, Revised Code of Washington, and the official Washington State Legislature bill history for HB 1155

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app