Beyond HIPAA: the new wave of US state health-privacy laws

The most common misconception in American health privacy fits in one sentence: HIPAA protects my health data. It does not. HIPAA — which turns thirty this August — protects health data held by a specific cast of organizations, and almost nothing about the same data once it lives anywhere else. The states noticed, and since 2023 they have been writing the laws that fill the gap, each a little different from its neighbors.

The result is a patchwork. But the patchwork has a pattern, and the pattern has a compliance answer.

The entity problem at HIPAA's core

HIPAA's privacy rules attach to covered entities — health plans, healthcare clearinghouses, and providers who bill electronically — plus their business associates, as the HHS HIPAA pages set out. The data itself carries no protection; the holder does. Step outside that cast and the same information changes legal character entirely: a diagnosis in your hospital's EHR is federally protected, while the identical fact inferred by an advertising platform from your searches is, federally speaking, fair game.

Most health data generated today is born outside the cast — wearables, period and mood trackers, symptom searches, supplement purchases, location trails. That outside world is a functioning marketplace, mapped in how health data gets bought and sold, and for research uses inside the regulated zone there are well-worn paths we cover in HIPAA and research. The new state laws aim at everything in between.

The dedicated laws: Washington, Nevada, Connecticut

2023 was the turning point, with the Dobbs decision as the proximate cause. Washington moved first and furthest with the My Health My Data Act: consumer health data defined broadly enough to include inferences from non-health data, affirmative consent to collect or share, a separate signed authorization — valid at most one year — to sell, a ban on geofencing health facilities, and enforcement by private lawsuit as well as the attorney general. It deserves its own deep read, which we give it in America's strictest health-privacy law.

Nevada followed with SB 370, covering consumer health data on similar terms — affirmative consent for collection and sharing, written authorization for sale, its own geofencing restrictions — but enforced by the attorney general alone, with no private right of action. Connecticut took a third route, amending its existing comprehensive privacy law to give consumer health data special status: opt-in consent, limits on geofencing around health facilities, and attorney-general enforcement.

Three laws, one family resemblance: all three regulate the data rather than the entity, all three demand consent before collection, and all three treat selling health data as an act requiring something close to ceremony.

The comprehensive laws: health as sensitive data

A second front advanced in parallel. Comprehensive state privacy laws — California's, Colorado's, Virginia's, and a list that has grown almost every legislative session since — treat health information as sensitive data. The usual formula: collecting or processing sensitive data requires opt-in consent (California instead gives consumers a right to limit its use), plus data-protection assessments for risky processing. None of these is a health-privacy law by title, but each moves health data into its most protected tier.

Meanwhile Congress has entertained comprehensive federal privacy bills for years without passing one. Until that changes, there is no preemption coming to flatten the patchwork — the states are the law.

What the patchwork does to research

For health research, the state wave cuts both ways. Most of these laws exempt HIPAA-covered data and carve out research conducted under recognized ethical frameworks, so traditional studies continue. But the carve-outs differ in wording, and the laws define "de-identified" data with differing strictness — a reminder that de-identification is a spectrum of legal meanings, not one thing, as we untangle in de-identified, anonymized, pseudonymized.

The deeper effect is directional. Every new statute moves the same way: more consent, narrower sharing, harder sales, stronger individual rights. No state has loosened health-data rules. A research platform betting on the gaps is betting against a trend with no counterexamples.

Build to the strictest

When fifty jurisdictions regulate one product, sane engineering picks the strictest requirement in each dimension and applies it everywhere — one codebase, one policy, no per-state behavior. Companies facing the GDPR learned this years ago; the US state wave teaches the same lesson domestically. Today that means MHMD-grade consent as the default: affirmative, specific, revocable, with the sale of health data treated as effectively off the table.

Mithras Health was designed with exactly that posture — Washington's My Health My Data Act sits alongside HIPAA, GDPR, UK GDPR, and the EHDS in the platform's design targets, and the strictest reading wins everywhere. The hardest provisions simply never trigger: Mithras never buys or sells data, so no sale-authorization machinery is ever needed. Consent runs ahead of every state's floor — each study gets its own revocable, scope-limited authorization from the patient, one decision recorded in two documents. And the append-only audit trail, retained for six years, means that compliance in any state is a query, not a reconstruction.

There is one more asymmetry worth naming, because it is the quiet gift of the state wave. A patchwork is expensive for companies that treat privacy as jurisdiction-shopping — every new statute means new exposure, new counsel, new exceptions. It costs almost nothing for the ones that picked the strictest rule early and built it into the machinery. Fifty legislatures, without coordinating, are slowly making the honest architecture the cheap one.