Most health data collected by apps and wearables falls outside HIPAA entirely, and Washington's My Health My Data Act was the first serious attempt to close that gap, complete with a private right of action. This hub covers that statute and the laws following it.
Consumer Health Data
October 5, 2026
Virginia protects reproductive and sexual health data through its general consumer protection statute rather than its privacy law. SB 754, enacted in 2025 as chapter 591, added a prohibited practice to Va. Code § 59.1-200 and a seven-part definition to § 59.1-198, bringing the Act's private damages action and Attorney General remedies with it.
Read more →
HIPAA
September 1, 2026
HHS finalised a rule in April 2024 restricting disclosure of information about reproductive health care to law enforcement and in litigation. In June 2025 a federal judge in Amarillo vacated nearly all of it, holding HHS had exceeded its authority. The government did not appeal, and the Fifth Circuit dismissed the intervenors' appeal in September 2025.
Read more →
Consumer Health Data
August 24, 2026
HIPAA attaches to a category of organisation. A newer class of state statute attaches to a category of information instead, defined by what it reveals about a person's health rather than by who holds it. This guide compares how Nevada, Maryland and Washington draw that line, and where the federal Health Breach Notification Rule sits alongside them.
Read more →
Consumer Health Data
August 12, 2026
Most health data collected by apps, wearables and websites falls outside HIPAA, which reaches only covered entities and their business associates. Washington's My Health My Data Act was the first US statute written specifically to close that gap, and it is enforceable by individuals rather than only by the state.
Read more →