Compliance Tool · Multi-State Overlay

Multi-State Consumer Health Data Checklist

Washington, Nevada, and Connecticut have different consumer health data privacy scopes and exemptions. Review each jurisdiction, entity, activity and data set before treating a control as a legal duty. These laws can reach digital health products, apps, wellness services and inferred health data, subject to their definitions and exceptions. Check items after confirming the applicable control or documenting why it is outside scope; leave unresolved applicability unchecked. Progress saves in this browser.

Sources: RCW 19.373, My Health My Data Act ↗ · Nevada SB 370 (2023) ↗ · Connecticut Data Privacy Act ↗ · Compiled as of July 19, 2026; the Connecticut applicability threshold and the §42-517 exemptions were reverified against Public Act 25-113 on September 20, 2026, and in the same pass the Washington, Nevada and Connecticut geofencing radii and covered facilities were reverified against RCW 19.373.080, NRS 603A.540 and §42-526, the Nevada HIPAA exemption against NRS 603A.490(1)(a), and the Nevada and Washington enforcement paths against NRS 603A.550 and RCW 19.373.090. The remaining Washington and Nevada rows were not reverified

–Items shown

–Checked off

–Complete

–Current view

Items are grouped by jurisdiction. Common to all three groups related controls for review; it does not mean every control applies to every organization. Washington has specified data exclusions, including PHI under HIPAA; non-PHI still requires a definition and exclusion analysis. Nevada exempts persons and entities subject to HIPAA from NRS 603A.400–.550. Connecticut exempts HIPAA covered entities and business associates from §§42-515–42-525, but §42-526 has separate scope and exception rules. An exemption here does not resolve other privacy laws. A jurisdiction filter does not determine applicability or automatically suppress controls. Keep the basis for each applicable, outside-scope or unresolved conclusion in your assessment record; checked progress is review status, not a legal-compliance score. Scope correction reviewed September 7, 2026.

Washington · My Health My Data

The strictest of the three and the only one with a private right of action, enforced through the Consumer Protection Act. No revenue or volume threshold: it reaches any regulated entity doing business in Washington or targeting Washington consumers.

Nevada · SB 370

Structurally close to Washington, with separate consent for collection and sharing and a distinct authorization for sale. Attorney General enforcement only, no private right of action, which is the practical difference that matters.

Connecticut · CTDPA

A comprehensive privacy law rather than a health-specific one. Consumer health data is sensitive data requiring opt-in consent, and applicability turns on consumer-volume thresholds that the other two do not have.

Effective dates and thresholds

Washington MHMDA geofencing prohibitionJuly 23, 2023

Washington MHMDA main obligationsMarch 31, 2024 (small business: June 30, 2024)

Nevada SB 370March 31, 2024

Connecticut CTDPAJuly 1, 2023; amended by Public Act 25-113, amendments effective July 1, 2026

Washington and Nevada applicability thresholdNone. Doing business in the state is enough

Connecticut applicability thresholdNot volume-only since July 1, 2026. Any one of: 35,000 consumers' personal data in the preceding calendar year (payment-transaction data excluded), or controlling or processing consumers' sensitive data with no consumer count, or offering consumers' personal data for sale (§42-516 as amended by P.A. 25-113 §6)

Why that matters hereConsumer health data is sensitive data, so a controller handling it can be in scope for §§42-515–42-525 on the sensitive-data trigger alone, with no threshold to fall under. Entity and data exemptions are assessed separately

Geofencing radius, Washington2,000 feet of an in-person health care facility

Geofencing radius, Nevada and Connecticut1,750 feet of a health care facility

Companion tools

California is covered separately and in more depth by the California Health Privacy Checklist, which walks CMIA, the AB 352 and AB 254 sensitive-services rules, and the state breach clocks. If you are assessing an AI or analytics vendor that touches any of this data, the AI Risk Assessment covers the contract terms. For the federal baseline underneath all of it, start with the HIPAA Privacy Rule Checklist.

This checklist compiles selected requirements from Washington's My Health My Data Act (RCW 19.373), Nevada SB 370 (2023), and the Connecticut Data Privacy Act, for general compliance-learning purposes. These statutes are recent, unevenly interpreted, and largely untested in litigation; several key terms including the scope of "consumer health data" itself remain unsettled, and section-level requirements change with amendment. This checklist is organized by obligation rather than by statutory subsection for that reason, and it is not a complete inventory of any of the three laws, nor of the other states that have enacted or are considering similar measures. This is not legal advice. Brandon Goulter is not an attorney, and using this checklist creates no professional advisory relationship. Verify current requirements against the primary sources linked above and confirm your own program's compliance with a licensed attorney before relying on this checklist. Checked items are stored only in your browser's local storage, nothing is transmitted or saved to any server.