Research · 12 min read
When a State Privacy Law Reaches a Telehealth Company
Two states regulate health data on the internet, and their triggers have almost nothing in common. One asks where you live and where the data was gathered. The other asks how big the company is, and lets a small one out of the statute entirely.
Key takeaways
- A privacy statute has to reach the company before its duties matter, and reach is decided by scope provisions rather than by how sensitive the data is.
- Washington's health data act has no size threshold: it reaches an entity that does business in the state or targets consumers there and decides the purpose and means of handling consumer health data.
- Its definition of consumer covers a state resident or a person whose health data is collected in the state, so residency is not the only route in.
- California's act reaches a for-profit business only where one of three thresholds is met, so a company under all three sits outside it.
- California's entity-level health exemption applies only to the extent the entity maintains patient information in the manner the statute describes, which is not a blanket exit.
- A separate California statute deems certain health apps into a medical confidentiality law, and says in the same breath that the deeming reaches no other law.
- Both statutes exclude a merger, acquisition or bankruptcy transfer from selling and sharing, and California attaches a prior-notice duty where the acquirer materially changes the use.
Answer first: scope is the question, and it is not about the data
People reading a privacy policy usually want to know whether a law protects them. That question has a first step most summaries skip.
A statute has to reach the company before any of its duties mean anything. Reach is decided by scope provisions, and those provisions ask about the business and about you, not about how sensitive the information feels.
Two states are described below. Washington regulates health data specifically. California regulates consumer data broadly and treats health information as a sensitive category inside that.
Their triggers barely overlap. Reading both is the fastest way to see that there is no single answer to the question of whether a state privacy law covers a telehealth company.
Washington's trigger has no size test at all
The Washington act defines a regulated entity as any legal entity that satisfies two conditions together.
First, it conducts business in Washington, or produces or provides products or services that are targeted to consumers in Washington.
Second, alone or jointly with others, it determines the purpose and means of collecting, processing, sharing or selling consumer health data.
That is the whole test. There is no revenue threshold, no customer count and no employee count in it.
The definition excludes government agencies, tribal nations, and contracted service providers when they are processing consumer health data on behalf of a government agency.
The second condition is the one that does real work. An entity that decides why and how data is handled is inside; one that only carries out another entity's instructions is a processor, with its own separate duties.
Who counts as a consumer, and why two people can get different answers
The same act defines a consumer two ways, joined by an or.
A natural person who is a Washington resident. Or a natural person whose consumer health data is collected in Washington.
The second limb does not ask where you live. It asks where the collection happened, which means a visitor can fall inside the definition without any connection to the state beyond that.
The definition then narrows in a way worth knowing. A consumer means a natural person acting only in an individual or household context, and it expressly does not include an individual acting in an employment context.
So a workplace wellness arrangement and a personal signup are not the same case under this statute, even for the same person and the same data.
A small business is still inside the statute
The act defines a small business, and the definition is easy to misread as an exemption.
A small business is a regulated entity that meets one or both of two thresholds. It collects, processes, sells or shares consumer health data of fewer than one hundred thousand consumers in a calendar year. Or it derives less than half of its gross revenue from those activities and handles the data of fewer than twenty-five thousand consumers.
The category is defined as a kind of regulated entity, not as an entity outside the chapter. Its duties are the same duties.
What the category actually changes is timing. Several sections state their own start dates, and each gives a small business a later one, in June 2024 rather than March 2024.
California's trigger is a size test, and a company can fall under it
California's consumer privacy statute defines a business as a for-profit legal entity that collects consumers' personal information, or on whose behalf that information is collected.
It must alone or jointly determine the purposes and means of processing. It must do business in California. And it must satisfy one or more of three thresholds.
The first is a revenue threshold, stated as a dollar figure in the statute and adjusted for inflation under another section of the same act.
The second is a volume threshold. Alone or in combination, the entity annually buys, sells or shares the personal information of one hundred thousand or more consumers or households.
The third is a business-model threshold. The entity derives half or more of its annual revenues from selling or sharing consumers' personal information.
An entity below all three is not a business under that act, and the act's duties do not attach to it. The statute also pulls in commonly branded affiliates that share personal information, certain joint ventures, and any company that voluntarily certifies compliance.
The health carve-outs, and the words that limit them
The California act then excludes health information twice, and the two exclusions work differently.
The first is about information. The act does not apply to medical information governed by the state's medical confidentiality statute. Nor does it apply to protected health information collected by a covered entity or business associate under the federal privacy, security and breach notification rules.
The second is about organizations, and it carries a limiting phrase. A provider of health care governed by the state statute is outside the act, and so is a covered entity under the federal rules. The exit runs only to the extent that entity maintains patient information in the same manner as the information described in the first exclusion.
That phrase decides a great deal. It is not a blanket exit for a company that also happens to run a clinical practice. It removes the patient information handled in that manner, and leaves everything else where it was.
A third exclusion covers personal information collected as part of a clinical trial or other biomedical research study. The study has to be conducted under the federal human subjects policy, under good clinical practice guidelines, or under federal drug regulator human subject protections.
Washington draws the same federal line from the other direction
The Washington act's exemption section opens with information rather than entities. The chapter does not apply to information meeting the definition of protected health information under the federal health privacy law and its regulations.
It lists further categories in the same paragraph. Among them are health care information handled under the state's own medical records chapter, and patient identifying information under the federal substance use disorder confidentiality regulations. Identifiable private information under the federal human subjects rules is on the list too.
There is also a mixing rule, and it is practical. Information originating from those categories, and intermingled to be indistinguishable from them, is exempt where the right kind of organization holds it. The holders named are a covered entity or business associate, a state-defined health care facility or provider, and a program under the substance use disorder regulations.
A second subsection exempts personal information governed by several federal regimes by name, among them the financial privacy statute, the federal health administrative simplification provisions, the credit reporting statute and the education records statute.
Read together with the federal boundary, the design is visible. The state act is aimed at the health data that the federal privacy rule does not reach, which is most of what a consumer app holds.
The California statute that pulls an app in, and the sentence that limits it
California has a separate medical confidentiality statute, older than its privacy act, and one section of it deems certain businesses into the rules.
A business that offers software or hardware to consumers, including a mobile application or other related device, can be deemed a provider of health care subject to that part. The product has to be designed to maintain medical information, so that the information can be made available to an individual or a provider of health care. That availability has to be at the request of the individual or of a provider.
The purpose clause narrows it. The design has to be for allowing the individual to manage their own information, or for the diagnosis, treatment or management of a medical condition.
Two later subdivisions extend the same treatment to a business offering a mental health digital service and to one offering a reproductive or sexual health digital service, in each case for those purposes.
And then the limiting sentence, which appears in every one of those subdivisions. The section is not to be construed as making such a business a provider of health care for purposes of any law other than that part. The exclusion expressly reaches laws that specifically incorporate the part's definitions by reference.
So the deeming is local. It brings the business inside one confidentiality statute and its penalties, and it does not make the business a health care provider anywhere else.
What both statutes say about a company being sold
Both acts define selling and sharing, and both carve the same transaction out of both definitions.
In Washington, sell does not include an exchange of consumer health data to a third party as an asset. The transaction has to be a merger, acquisition, bankruptcy or other deal in which the third party assumes control of all or part of the entity's assets, and complies with the chapter. The definition of sharing carries the matching exclusion.
California does the same, and then adds a duty. A third party may materially alter how it uses or shares the personal information. Where that alteration is materially inconsistent with the promises made at the time of collection, the third party must give prior notice of the new or changed practice.
That notice has to be sufficiently prominent and robust for existing consumers to exercise their choices. The subparagraph also states that it does not authorize retroactive privacy policy changes.
The plain reading is that a change of ownership is a route by which records move without either statute treating the move as a sale. What the acquirer may then do with them is governed by the promises made when the data was collected, plus that notice duty.
What happens if a company refuses a request
The Washington act builds a route and names its end point. A consumer may confirm whether an entity is collecting, sharing or selling their consumer health data, access it, withdraw consent, and request deletion.
The entity has to answer without undue delay, and in all cases within forty-five days. One extension of a further forty-five days is available where reasonably necessary. It is conditioned on telling the consumer within the first period and giving the reason.
Responses are free up to twice a year for each consumer. Where a request is manifestly unfounded, excessive or repetitive, the entity may charge a reasonable administrative fee or decline, and the statute puts the burden of demonstrating that on the entity.
There has to be an appeal process, conspicuously available and similar to the request process, with a written answer within forty-five days. Where an appeal is denied, the entity has to give the consumer an online mechanism, if one is available, or another method for contacting the state attorney general to submit a complaint.
Enforcement runs through the state's consumer protection statute. The act states that a violation of the chapter is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purposes of that statute.
The private route under that statute has its own limit worth knowing. It gives a civil action to a person injured in their business or property by a violation, which is a narrower gate than the fact of a violation on its own.
What this does not decide
It does not say whether any company is a regulated entity, a business, a provider of health care or a covered entity. Those are legal conclusions about a specific business and depend on facts a website does not show.
It does not describe the law of any state other than the two named. Other states have passed health privacy and consumer privacy statutes with different triggers and different exemptions.
It does not tell you which rules apply to you personally. Under one of these acts that depends on where you live or where collection happened, so two people using the same service can have different answers.
And it is not legal advice. It reports what a set of scope provisions say, read to the end of each one.
Sources
- RCW 19.373.010, "Definitions"The definition of regulated entity, requiring both that the entity conduct business in Washington or produce or provide products or services targeted to consumers in Washington, and that it alone or jointly determine the purpose and means of collecting, processing, sharing or selling consumer health data, with the exclusion of government agencies, tribal nations and their contracted service providers. The definition of consumer as a Washington resident or a natural person whose consumer health data is collected in Washington, acting only in an individual or household context and not in an employment context. The definition of small business and its two thresholds. The definitions of sell and share, including the exclusion for an exchange or transfer to a third party as an asset that is part of a merger, acquisition, bankruptcy or other transaction in which the third party assumes control of assets and complies with the chapter. The definition of processor.
- RCW 19.373.100, "Exemptions"The exemption for information meeting the definition of protected health information under the federal health insurance portability and accountability act and related regulations, and the further listed categories including health care information under chapter 70.02 RCW, patient identifying information under 42 CFR Part 2, and identifiable private information under the federal human subjects rules. The intermingling provision for information originating from those categories and maintained by a covered entity or business associate, a state-defined health care facility or provider, or a program under the substance use disorder regulations. The second subsection exempting personal information governed by named federal regimes, including the Gramm-Leach-Bliley Act, part C of Title XI of the Social Security Act, the Fair Credit Reporting Act and the Family Educational Rights and Privacy Act.
- RCW 19.373.040, "Consumer rights and requests — Refusal — Appeal"The rights to confirm collection, sharing or selling and to access the data with a list of third parties and affiliates, to withdraw consent, and to request deletion. The forty-five day response period, the single forty-five day extension conditioned on notice and a reason given within the first period, the free-of-charge rule up to twice annually, the reasonable fee or refusal for manifestly unfounded, excessive or repetitive requests with the burden on the entity, and the appeal process with its written answer and its requirement that a denied appeal be accompanied by a mechanism to contact the attorney general.
- RCW 19.373.090, "Application of consumer protection act"The statement that the practices covered by the chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, and that a violation of the chapter is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying that act.
- RCW 19.86.090, "Civil action for damages — Treble damages authorized"That the civil action under the state consumer protection statute is available to any person who is injured in his or her business or property by a violation of the listed sections, to enjoin further violations, to recover actual damages, or both, together with costs including a reasonable attorney's fee.
- California Civil Code section 1798.140, "Definitions"The definition of a business as a for-profit legal entity that collects consumers' personal information or on whose behalf it is collected, that alone or jointly determines the purposes and means of processing, that does business in California, and that satisfies one or more of three thresholds: an annual gross revenue figure adjusted under section 1798.199.95, annually buying, selling or sharing the personal information of one hundred thousand or more consumers or households, or deriving fifty percent or more of annual revenues from selling or sharing consumers' personal information. The inclusion of commonly branded controlled entities that share personal information, of joint ventures meeting a stated ownership interest, and of entities that voluntarily certify compliance. The exclusions from the definitions of sell and share for a transfer of personal information as an asset that is part of a merger, acquisition, bankruptcy or other transaction in which a third party assumes control, and the prior notice duty where the third party materially alters how it uses or shares the information in a manner materially inconsistent with the promises made at collection.
- California Civil Code section 1798.145, "Exemptions"The provision that the title does not apply to medical information governed by the Confidentiality of Medical Information Act or to protected health information collected by a covered entity or business associate governed by the federal privacy, security and breach notification rules. The separate provision for a provider of health care governed by that state act or a covered entity governed by those federal rules, which applies only to the extent the provider or covered entity maintains patient information in the same manner as the information described in the first provision. The exclusion for personal information collected as part of a clinical trial or other biomedical research study subject to the federal policy for the protection of human subjects, good clinical practice guidelines, or federal drug regulator human subject protection requirements. The provision borrowing the definitions of medical information and provider of health care from section 56.05 and the definitions of business associate, covered entity and protected health information from 45 CFR 160.103.
- California Civil Code section 56.06, within the Confidentiality of Medical Information ActThe provision deeming a business that offers software or hardware to consumers, including a mobile application or other related device, designed to maintain medical information so that it can be made available to an individual or a provider of health care at the request of the individual or a provider, for purposes of allowing the individual to manage their information or for the diagnosis, treatment or management of a medical condition, to be a provider of health care subject to that part. The parallel provisions for a mental health digital service and for a reproductive or sexual health digital service. The limiting sentence in each of those subdivisions stating that the section is not to be construed to make such a business a provider of health care for purposes of any law other than that part, including laws that specifically incorporate the part's definitions by reference. The provisions requiring such a business to maintain the same standards of confidentiality required of a provider of health care and subjecting it to the part's penalties for improper use and disclosure.
Frequently asked questions
Does a state privacy law apply just because a company handles health information?
No. Each statute has a scope provision, and the scope provision comes first. Washington's health data act reaches a legal entity that conducts business in the state or targets products or services to consumers there, and that determines the purpose and means of handling consumer health data. California's consumer privacy act reaches a for-profit entity doing business in the state that meets at least one of three size thresholds. A company can handle a great deal of health information and still fall outside one or both tests.
Can a small company be outside these laws entirely?
The two states answer differently, which is the clearest illustration of how much scope matters. California's definition of a business requires one of three thresholds to be met. A revenue figure the statute names and adjusts for inflation. Buying, selling or sharing the personal information of one hundred thousand or more consumers or households. Or deriving half or more of annual revenue from selling or sharing personal information. An entity below all three is not a business under that act. Washington's act has no size test in its definition of a regulated entity, and its small business category is a kind of regulated entity with later start dates rather than an exemption.
I do not live in Washington. Can its law still matter to me?
Possibly, because the definition of consumer has two limbs. It covers a natural person who is a Washington resident, and separately a natural person whose consumer health data is collected in Washington. The second limb turns on where the collection occurred rather than on residency. The same definition also limits itself to a person acting in an individual or household context and expressly excludes an individual acting in an employment context.
If a company is already covered by the federal health privacy rules, do the state laws still reach it?
Both statutes carve federal protected health information out, and the wording is where the detail lives. Washington's exemption section says the chapter does not apply to information meeting the definition of protected health information under the federal law and its regulations. It adds a rule for information intermingled with such data so as to be indistinguishable. California excludes that information as well. It separately excludes a covered entity or a provider of health care governed by the state confidentiality statute, but only to the extent the entity maintains patient information in the same manner.
Is a health app treated as a health care provider in California?
One statute deems certain businesses into one law. A business offering software or hardware to consumers, including a mobile application or related device, may fall inside it. The product has to be designed to maintain medical information, so that it can be made available to an individual or a provider at their request. The purpose has to be managing the individual's own information, or the diagnosis, treatment or management of a medical condition. Such a business is then deemed a provider of health care subject to that part. The same subdivision states that this does not make it a provider of health care for purposes of any other law, including laws that incorporate the part's definitions by reference.
What happens to my information if the company is bought or goes under?
Both statutes exclude that transfer from their definitions of selling and sharing. Washington excludes an exchange to a third party as an asset that is part of a merger, acquisition, bankruptcy or other transaction where the third party assumes control of assets and complies with the chapter. California excludes the same transfer and adds a duty. The acquirer may materially alter how it uses or shares the information. Where that is materially inconsistent with the promises made at the time of collection, it must give prior notice. The notice has to be sufficiently prominent and robust for consumers to exercise their choices.
Who enforces the Washington act?
The act routes itself into the state consumer protection statute rather than creating a separate penalty. It states that a violation of the chapter is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purposes of that statute. The consumer protection statute's civil action is available to a person injured in their business or property by a violation, which is a narrower gate than a violation alone. The act separately requires an entity denying a consumer appeal to give the consumer a way to contact the state attorney general with a complaint.