Your Website Can Break a Health Data Law You've Never Read

The quote form that answers to a law you've never read

Say your agency is based in Texas. You write ACA and Medicare Advantage business, your quote form sits on a page you built two years ago, and it has a Meta Pixel and a Google Analytics tag firing the second the page loads, the way most agency funnel pages still do. A visitor from Spokane fills it out, picks a plan filtered by a chronic condition note in the free text field, and leaves. You never advertised in Washington. You may not even hold a Washington license yet. None of that matters.

That visitor's state now has a say in what just happened on your website, because the data your form collected and the pixel passed along, a plan search tied to a health condition, is exactly what Washington's My Health My Data Act defines as regulated. The law doesn't ask where your agency sits. It asks where the consumer was when your site collected the data, and whether you had their consent before you collected or shared it.

Nevada passed a similar law the same year, with its own definitions, its own penalty structure, and one important difference in who can bring a case. Between the two, an agency running quote forms and plan finders that reach a national audience, which is most independent agency websites, now has two separate state laws to answer to that have nothing to do with where the agency's office actually is.

Why your state doesn't matter. The visitor's does.

Both statutes define who they regulate the same way, and it is worth reading the actual language once because most agencies assume the opposite. Washington's definition of a "regulated entity" is any legal entity that conducts business in Washington or produces or provides products or services targeted to consumers in Washington, and alone or jointly with others determines the purpose and means of collecting, processing, sharing, or selling consumer health data². Nevada's definition is almost identical in structure: any person who conducts business in Nevada or produces or provides products or services targeted to consumers in Nevada, and who determines the purpose and means of processing, sharing, or selling that data⁷.

Neither definition requires a physical office, a mailing address, or even a state insurance license in that state. It requires conducting business with, or targeting, a consumer there. Taking a quote from a Washington or Nevada resident, through a form that collects or a pixel that shares health-adjacent data, is conducting business with that consumer. A national SEO strategy, a Facebook ad set to "United States," or an organic blog post that ranks nationally is, by definition, targeting consumers in every state it reaches, these two included.

That is the mechanism the rest of this guide is built around. It is not about whether you operate in Washington or Nevada. It is about whether your website's quote forms, plan finders, and tracking scripts can reach a resident of either state, and almost every agency website that ranks organically or runs national ads can.

Washington's My Health My Data Act, in plain terms

Washington's statute, codified at RCW 19.373, defines consumer health data broadly: personal information linked or reasonably linkable to a consumer that identifies their past, present, or future physical or mental health status. The statute's own list includes health conditions, treatments, diagnoses, and surgeries; prescription medication use; bodily functions, vital signs, or symptoms; reproductive or sexual health information; gender-affirming care information; biometric and genetic data; and location data that could reveal someone is seeking health services³. It also covers data inferred from non-health information through an algorithm, so a plan recommendation engine that infers a likely condition from a few quiz answers is squarely inside the definition even if the visitor never typed the word "diagnosis."

Collecting that data requires consent for a specified purpose, or it must be necessary to deliver a product or service the consumer actually requested. Sharing it with anyone else, including an ad platform, requires a second, separate consent, distinct from the consent to collect, and both consents have to be obtained before the collection or sharing happens, not after, with the request clearly disclosing the data categories, the purpose, who receives it, and how to withdraw⁴. That "before, not after" timing is the exact detail most agency quote pages get wrong, because most consent banners on agency sites today exist to look compliant, not to actually gate anything that loads before a click.

The statute separately bans geofencing: implementing a virtual boundary around any place that provides in-person health care services for the purpose of identifying or tracking people seeking care, collecting their health data, or sending them notifications or ads tied to their health data or health care⁵. Washington's law does not state a distance for this ban, which makes it broader on its face than Nevada's, covered below.

Enforcement runs through Washington's Consumer Protection Act: a violation of the health data statute is automatically an unfair or deceptive act under RCW 19.86⁸, and that chapter lets a court treble the actual damages a plaintiff proves, up to a cap of $25,000 per case, plus attorney's fees and costs¹. The Washington Attorney General's own guidance confirms the Act is enforced both by the Attorney General and through private action, meaning an individual resident, not just the state, can bring a case⁹. Per that same guidance, regulated entities that are not small businesses had to be in compliance by March 31, 2024, with small businesses given until June 30, 2024⁹.

Nevada's consumer health data law, and where it differs

Nevada's statute lives in NRS Chapter 603A, and its definition of consumer health data covers much of the same ground: personal information linked or reasonably capable of being linked to a consumer that identifies their past, present, or future physical or mental health status, including conditions, treatments, prescription use, reproductive or sexual health information, gender-affirming care information, and biometric or genetic data⁷. It excludes information used solely to enable video game play or to identify ordinary shopping habits, as long as that information doesn't reveal health status.

Nevada requires a regulated entity to maintain and post a consumer health data privacy policy on its main website describing what it collects, how it's used, its sources, who it's shared with, and how it's processed, with a separate consent required before collecting or sharing any category, recipient, or purpose not already disclosed in that policy¹⁰. Collection and sharing each require their own affirmative, voluntary consent, obtained before the activity happens, disclosing the categories, purposes, recipients, and withdrawal method, mirroring Washington's structure almost exactly ¹¹.

Where Nevada goes further is on the sale of health data specifically. Selling it to anyone requires a separate written authorization in plain language naming the buyer, the data involved, and the purpose. That authorization expires automatically one year after it's signed, can be revoked at any time, cannot be made a condition of receiving a product or service, and a copy has to be given to both the consumer and the buyer and kept on file for six years¹². Washington's consent rule for sharing covers a sale as a form of sharing, but Nevada's statute adds this standalone set of mechanics on top, which an agency's data-licensing or list-rental arrangements, if it has any, would need to satisfy separately.

Nevada's geofencing ban is more specific than Washington's: it is unlawful to implement a geofence within 1,750 feet of a medical facility, a facility for people with disabilities, or another in-person health care provider, for the purpose of identifying or tracking consumers seeking care, collecting their health data, or sending them related messages¹³.

Enforcement is where the two states split hardest. A violation of Nevada's consumer health data provisions is treated as a deceptive trade practice, which puts it under the penalty structure in NRS 598, and the statute says plainly that it creates no private right of action¹⁴. Only the state can bring a case, through the Attorney General or the Nevada Commissioner of Consumer Affairs, and the available administrative penalty is a fine of up to $15,000 per violation, or treble the restitution ordered, whichever is greater⁶. Independent legal trackers covering Nevada's 2023 legislative session place the law's effective date at the same March 31, 2024 date as Washington's¹⁵¹⁶, though unlike Washington, Nevada gave no extra runway for small businesses.

Washington versus Nevada, side by side

The two statutes share a structure, a definition of health data, and an effective date, but they diverge on exactly the points that decide how exposed an agency actually is: who can bring a case, and what it costs.

What a violation actually costs

Run the numbers on a single incident. Say a Washington resident's quote, tied to a Medicare Advantage search filtered by a chronic condition, gets passed to an ad platform through a pixel that fired before any consent was captured. If that resident sues, RCW 19.86.090 lets a court treble their actual damages up to the $25,000 cap, and separately award the cost of the suit and a reasonable attorney's fee¹. The $25,000 is a cap on the trebled portion, not a ceiling on total recovery once fees are added, and nothing in the statute requires the state to act first. One resident with a real grievance and a lawyer is enough.

Nevada's exposure runs differently but isn't smaller in practice once volume enters the picture. NRS 598.0971(3)(d) lets the state impose an administrative fine of up to $15,000 for each violation, or treble the restitution ordered, whichever is greater⁶, and because the statute counts per violation rather than per case, a single misconfigured pixel firing across a month of Nevada quote submissions is not automatically one violation. No private resident can bring that case, which caps the practical risk at a regulatory action rather than a wave of individual lawsuits, but a state investigation into an agency's ad tags is not a theoretical event either. Both state Attorneys General enforce consumer protection statutes as a normal part of their office's work, and a health data complaint from a single resident is what typically opens that door.

What on an insurance site counts as health data

Neither statute requires a medical record to trigger. Ordinary insurance shopping tools collect exactly the categories both laws define, once you look at them through that lens instead of through "this is just how a quote form works."

How to check your own exposure

None of this requires a lawyer to start checking. Twenty minutes with your own site's quote and plan pages open will tell you most of what you need to know.

How we build this in from the start

This is the kind of problem that is expensive to retrofit and nearly free to build in from day one, which is the whole argument for doing it at the architecture level instead of page by page. Every site we build runs on Astro, which ships pages as finished HTML rather than loading a runtime and a stack of plugins before anything on the page can run, and nothing non-essential, analytics included, loads before a visitor makes an explicit consent decision. The consent state is decided before first paint, not faded in by a script after the page has already rendered, which is also part of what lets our builds score 90 or higher on Lighthouse performance on both mobile and desktop.

The free Audit checks exactly this: whether your site's trackers fire before consent, alongside how well AI answer engines can read and cite your pages, in about 30 seconds on screen with a fuller report emailed after¹⁸. Digital Foundation builds the fix in permanently, starting at $84 a month for a complete, compliant site with a 14-day free look period before any billing starts¹⁷.

What changes once this is handled

A site built this way stops being a liability that happens to also be a marketing asset. Tracking still works, because consent-gated analytics is still analytics, it just loads after a real decision instead of before one. The privacy policy both statutes require is a standing page instead of a scramble if a resident or an Attorney General's office ever asks for it. And because the fix is architectural rather than a page-by-page patch, it holds the next time a state adds a similar law, which, per the next section, is worth planning for.

Washington and Nevada are not the end of the list

Washington and Nevada were the first two states to pass a consumer health data law this specific, both in 2023 and both effective the same day in 2024, which is itself a signal that this was not a one-state experiment. We're not going to name every state considering similar legislation here, because a bill's status changes faster than a guide like this can stay current, and this article holds itself to only the language actually in force and verified this session. The practical takeaway doesn't depend on the exact count: if your agency's website reaches a national audience, which organic search and national ad campaigns both do by design, treating consent and consumer health data as a two-state problem is already behind where the law is heading.

Questions agents ask