State Health Privacy Laws: A Reference Table

State health privacy laws now regulate a category of data HIPAA never reached: consumer health data collected from people who are not your patients yet. Washington's My Health My Data Act is the most consequential because it carries a private right of action, Maryland's Online Data Privacy Act because it bans the sale of sensitive data outright, and roughly twenty comprehensive state privacy laws require opt-in consent before processing health data at all. Curve is HIPAA-compliant ad tracking with a signed BAA on every plan, and the same field-level control that satisfies HIPAA is what makes these state regimes tractable.

Why these apply to you even if you are HIPAA-covered

The common assumption is that a HIPAA-covered clinic is carved out of state privacy law. Read the exemptions carefully, because many of them exempt the data rather than the entity.

A data-level exemption removes PHI governed by HIPAA from the statute's scope. It does not remove everything else you collect. The person browsing your service pages who has never booked an appointment is not a patient, so their data is not PHI, so the HIPAA exemption does not reach it. That visitor is exactly who your advertising is aimed at, and their behavior on your site is what tracking technologies capture.

The practical consequence is that a covered entity can be fully HIPAA-compliant with respect to its patients and still be squarely inside a state consumer health data law with respect to its website traffic. Check the exemption language in each statute rather than assuming entity-level relief.

The dedicated consumer health data laws

• Washington, My Health My Data Act. Enacted April 2023. The geofencing prohibition took effect July 23, 2023 and the main obligations on March 31, 2024, with a later compliance date for small businesses. It requires consent before collecting consumer health data, separate consent before sharing it, and a signed authorization before any sale. Its defining feature is enforcement through Washington's Consumer Protection Act, which supplies a private right of action. The first suit under it, Maxwell v. Amazon.com, was filed February 10, 2025 in the Western District of Washington over SDK-based location data collection. No other state health privacy law puts this power directly in consumers' hands.
• Nevada, SB 370. Effective March 31, 2024. Structurally similar to Washington on consent, sale, and geofencing, and materially different in one respect: it does not provide a private right of action. Enforcement runs through the Attorney General.
• Connecticut, consumer health data amendments to the CTDPA. Effective July 1, 2023. Narrower in scope than Washington and Nevada, and notable for a specific geofencing prohibition: no geofence within 1,750 feet of any mental health, reproductive, or sexual health facility for the purpose of identifying or tracking consumers, collecting their health data, or sending them notifications about it.

The geofencing rules deserve separate attention from paid media teams, because radius targeting around a facility is a standard tactic that these statutes address by name.

The comprehensive privacy laws that reach health data

Roughly twenty states have comprehensive consumer privacy laws in effect as of 2026, with Indiana, Kentucky, and Rhode Island joining on January 1, 2026. Nearly all of them classify health data as sensitive data and require opt-in consent before processing it. California, Utah, and Iowa are the exceptions, using opt-out structures instead.

• Maryland, Online Data Privacy Act. Effective October 1, 2025, with enforcement beginning April 1, 2026. The strictest of the group. It bans the sale of sensitive data, which includes personal data used to identify a consumer's physical or mental health status, regardless of consent. It also permits collection and processing of sensitive data only when strictly necessary to provide the requested product or service, again regardless of consent. Consent is not a workaround under this statute.
• Texas, Data Privacy and Security Act. Effective July 1, 2024. Requires consent before processing sensitive personal data. Enforcement rests solely with the Attorney General, who established a dedicated privacy enforcement task force in June 2024. Civil penalties reach $7,500 per uncured violation, with a 30-day cure period that does not sunset.
• California, CCPA as amended by CPRA, alongside the Confidentiality of Medical Information Act. California treats health information as sensitive personal information subject to limitation rights rather than opt-in consent, and it has the most active enforcement record. In July 2025 the Attorney General reached a $1.55 million settlement with Healthline Media, the largest CCPA settlement to date, over failures to honor opt-outs and over sharing data suggesting a serious health condition. The order includes a term barring Healthline from sharing article titles that reveal a consumer may already have a diagnosis, which is a direct statement about what a URL discloses.

What is coming

New York's Health Information Privacy Act would be the strictest state health privacy law yet, applying to regulated health information far broader than HIPAA's PHI, including health-related browsing and wellness habits. Its history has been unusually long: an earlier version passed both chambers in January 2025 and was vetoed in December 2025. A revised bill, S9269, passed the Senate on June 3, 2026 and the Assembly on June 4, 2026. It would take effect one year after signing. Confirm its current status before planning against it, because it was awaiting executive action at the time of writing.

The four obligations that recur

Rather than tracking twenty statutes individually, most teams are better served by building to the strictest common denominator. Four requirements appear again and again.

Consent before collection, and separate consent before sharing. Washington splits these deliberately. A single banner click that covers both is unlikely to satisfy the statute.

Authorization before sale, and a broad definition of sale. Several of these laws define sale to include disclosure for valuable consideration, not only for money. Passing data to an ad platform in exchange for better targeting is arguably inside that definition, which is where the theory bites for advertising specifically. In Maryland the question does not arise, because the sale of sensitive data is prohibited outright.

Geofencing prohibitions around health facilities, with Connecticut specifying 1,750 feet.

Consumer rights, including access, correction, deletion, and opt-out of targeted advertising, with deletion the operationally hardest because it has to propagate to every downstream system that received the data.

How Curve maps to these requirements

Every obligation above is ultimately a question about what data left, to whom, and under what condition. That is a data flow problem before it is a legal one, and most healthcare marketing stacks cannot answer it because the answer lives inside a third-party tag's defaults.

Curve's tracking script installs in place of the Meta Pixel and Google tag, so events go to Curve's US-hosted infrastructure rather than directly to ad platforms. From there, per-destination field mapping decides what forwards, with nothing sent by default and only explicitly mapped fields moving. That enumeration is the artifact these statutes effectively require: a defensible, field-by-field statement of exactly what reaches each destination, rather than an inference about what a tag might be sending.

Identifiers are SHA-256 hashed per each platform's conversion API requirements. Neutral event aliases mean the ad platform receives a generic conversion name rather than a service line, which addresses the Healthline problem directly, since what the platform learns is a conversion rather than a condition. PHI-pattern detection flags payloads containing PHI-shaped values so changes upstream surface as alerts. Consent management is available for organizations that need granular category controls tied to the collection and sharing distinctions these laws draw.

For the destination-side configuration, see our guides to Google Ads Enhanced Conversions without PHI leakage and HIPAA-compliant conversion tracking across Google, Meta, and Microsoft.

A baseline that works across states

Five decisions cover the majority of the exposure without requiring a fifty-state analysis.

1. Treat health-adjacent behavioral data as sensitive by default, in every state, rather than by jurisdiction. Geographic segmentation of privacy controls fails the moment someone travels.
2. Separate consent for collection from consent for sharing, because Washington requires it and no other state penalizes you for the additional granularity.
3. Stop sending anything a reasonable person would call a sale of health data to ad platforms. Under Maryland this is not negotiable, and under the others it is the highest-risk activity.
4. Remove radius targeting around health facilities from your paid media plans, including competitors' locations.
5. Build deletion propagation before you are asked, so a request can actually reach every downstream system rather than only your CRM.

Email and SMS deserve their own review under these rules, since segmentation there is often condition-based by design. Our assessment of Klaviyo's posture for DTC health covers that layer, and our piece on how privacy, billing, and tracking end up in one complaint shows how these theories get combined by regulators.

Frequently asked questions

Does HIPAA compliance satisfy these state laws?

Not on its own. Many of these statutes exempt PHI rather than exempting HIPAA-covered entities, which leaves your non-patient website traffic in scope. Read the exemption in each statute rather than assuming entity-level relief.

Which state law creates the most litigation risk?

Washington's My Health My Data Act, because it is enforceable through the state Consumer Protection Act and therefore carries a private right of action. The other consumer health data laws rely on attorney general enforcement.

What counts as consumer health data?

Broader than PHI. The definitions generally reach any information that identifies a consumer's past, present, or future physical or mental health status, including inferences drawn from behavior. Visiting a page about a condition can qualify.

Is sending data to an ad platform a "sale"?

Potentially. Several definitions include disclosure for valuable consideration rather than money alone, which can capture data shared in exchange for targeting or measurement value. Maryland removes the question by banning the sale of sensitive data outright.

Do we have to comply if we only operate in one state?

Your customers determine the answer, not your offices. These laws generally apply based on the residence of the consumer whose data is processed, so a single-location practice with out-of-state website visitors can be in scope.

How should we handle the geofencing rules?

The safest posture is to stop radius targeting around health facilities entirely, including your own and competitors'. Connecticut's 1,750-foot rule is specific, and the practical value of that tactic rarely justifies the analysis it now requires.

Where to start

Begin with a data map rather than a legal memo. Write down every destination that receives visitor or patient data, what fields each one gets, and on what legal basis. Nearly every obligation in these statutes resolves against that document, and nearly every organization discovers gaps while building it.

Our free compliance scanner handles the first column by reporting what is loading on your site and transmitting data today. To see how per-destination field mapping produces the enumerated data flow these laws effectively demand, with a signed BAA on every plan, visit curvecompliance.com.

Reviewed August 2026. This is general information, not legal advice. State privacy law changes quickly and pending bills may have been enacted, amended, or defeated since this was written. Consult qualified counsel about your obligations in the states where your consumers reside.