State-by-State Health Data Privacy Law Tracker

Why State Law Matters More Than HIPAA Alone

For three decades, HIPAA has served as the de facto floor for health data privacy in the United States. But the landscape has changed dramatically. The proliferation of consumer health apps, wearables, genomic testing services, AI diagnostic tools, and direct-to-consumer telehealth platforms has created a vast ecosystem of health-sensitive data that HIPAA was never designed to reach. HIPAA covers covered entities and their business associates — it says nothing about a fitness app that tracks your menstrual cycle, a mental wellness platform that stores your therapy transcripts, or an AI model trained on de-identified imaging studies.

States have stepped into that gap with urgency. As of April 2026, twenty states have enacted comprehensive consumer privacy laws, all of which classify health data as sensitive and impose heightened protections. Several states — Washington, Nevada, and New York — have gone further by passing stand-alone consumer health data privacy laws that apply regardless of whether an entity is a HIPAA covered entity. More are moving through legislatures in 2026 and beyond.

For healthcare AI developers and data infrastructure operators — the core constituency of Radiant AI Health Data — the compliance burden is compounded. A de-identified dataset sourced from patients in Washington, California, and Maryland carries three different legal frameworks for how it may be collected, processed, shared, and sold. Getting this wrong isn't just a compliance problem; it is an existential business risk.

The Federal Baseline: HIPAA and Its Limits

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, implemented in 2003 and last substantively updated in 2013, establishes national standards for the protection of individually identifiable health information. It applies to covered entities (health plans, healthcare clearinghouses, and most healthcare providers) and their business associates.

HIPAA's de-identification standard — codified at 45 CFR §164.514(b) — permits two methods: the Safe Harbor method (removal of 18 specific identifiers) and the Expert Determination method (statistical verification that re-identification risk is very small). Once properly de-identified, data falls outside HIPAA's protections entirely — and may be freely sold, shared, or used for AI training purposes under federal law.

The critical limitation for 2026 and beyond: HIPAA de-identification does not equal compliance with state law. Washington, Maryland, and several other states impose consent requirements on the collection of consumer health data, not just its disclosure — a fundamentally different legal posture than HIPAA's framework.

Tier 1: Stand-Alone Consumer Health Privacy Laws

These states have enacted laws whose primary purpose is consumer health data privacy, extending far beyond HIPAA's covered entity scope. They impose the most rigorous consent requirements and carry meaningful private rights of action.

Washington's MHMDA is widely considered the most aggressive consumer health privacy law in the country. It applies to any entity that collects, shares, or sells the consumer health data of Washington residents — regardless of whether that entity is a HIPAA covered entity. "Consumer health data" is defined broadly to include any personal information that identifies a consumer's physical or mental health status. Notably, geofencing technology around healthcare facilities — a practice used by some data brokers and advertisers — is explicitly prohibited.

Tier 2: Comprehensive Privacy Laws with Broad Health Definitions

Ten states have enacted comprehensive privacy laws that define consumer health data broadly — encompassing not just diagnosis, but also health status, conditions, and related information. These laws require opt-in consent for processing sensitive data and impose data protection assessment obligations.

Tier 3: Comprehensive Privacy Laws with Narrow Health Definitions

Nine states define consumer health data narrowly — primarily as clinical diagnosis. An entity that collects heart rate data, menstrual cycle data, or mental wellness scores from a consumer app may not be subject to health-specific protections in these states, even if the data is sensitive in practice.

Tier 4: Sector-Specific and Biometric Laws with Health Relevance

Several states without comprehensive privacy frameworks have enacted targeted laws that are material to health data governance — particularly for organizations using biometric data, genetic information, or patient records.

States to Watch in 2026–2027

The legislative calendar for 2026 is active. Several significant state bills are moving through committees or awaiting final votes that would materially expand health data protections.

De-Identification Standards Across State Frameworks

De-identification is both a compliance tool and a business strategy. For healthcare AI companies that monetize de-identified datasets, the specific de-identification standard recognized by each state jurisdiction determines whether a dataset is legally outside the scope of privacy requirements — or still regulated as consumer health data.

The emerging consensus pattern across state laws is as follows:

• HIPAA Safe Harbor (45 CFR §164.514(b)(2)): Recognized as the baseline de-identification standard in Washington, California, New York (pending), and most states that explicitly reference de-identification. Removal of all 18 HIPAA-specified identifiers is required, with no actual knowledge that the remaining information could identify an individual.
• Expert Determination (45 CFR §164.514(b)(1)): Accepted in most jurisdictions, but New York's pending NY HIPA bill would require third-party certification of the statistical analysis — adding cost and process overhead compared to the current HIPAA model.
• State-specific standards: Maryland has signaled that its AG may apply a stricter interpretation of de-identification than HIPAA's baseline, particularly for datasets that combine health data with precise geolocation. No formal regulatory guidance has been issued yet as of Q1 2026.
• Re-identification risk: California's CPRA requires that de-identified data include technical safeguards preventing re-identification and that businesses contractually prohibit re-identification by downstream recipients. This mirrors HIPAA's existing BAA re-identification prohibition but extends it to the CPRA context.

The key open question for 2026 is whether state AGs will begin to challenge datasets labeled as "de-identified" that were compiled using geolocation proximity to healthcare facilities, clinical visit patterns, or behavioral health indicators — all of which are highly specific to individual health context even after formal identifier removal.

Notable Enforcement Actions and Emerging Trends

Enforcement is no longer a theoretical risk. Multiple state attorneys general have opened investigations and reached settlements in 2024–2026 involving consumer health data handled by non-HIPAA entities. The following actions are illustrative of enforcement priorities.

Cross-Cutting Themes for Healthcare AI Organizations

Several patterns emerge from the state-by-state landscape that are directly material to healthcare AI developers, data platform operators, and governance teams:

Implications for Data Governance and AI Infrastructure

For organizations building healthcare AI infrastructure — including data aggregation platforms, de-identification pipelines, and AI training dataset marketplaces — the state privacy landscape creates both compliance complexity and competitive opportunity.

Organizations that operationalize state-specific compliance at the data layer — mapping each data element to its source jurisdiction, consent record, and applicable law — will be able to move faster, monetize data more broadly, and provide their institutional partners with the legal defensibility they require. Those that do not will face mounting regulatory exposure as enforcement activity accelerates.

The practical implication is that consent management, provenance tracking, and de-identification documentation can no longer be afterthoughts in AI data pipeline design. They must be foundational infrastructure elements — logged, auditable, and jurisdiction-aware from the moment data enters a system.

This tracker will be updated on a quarterly basis or when material legislative or enforcement developments occur. For questions about how RAIHD's data governance infrastructure addresses state-specific compliance requirements, reach out directly or explore our Health AI Data Model overview.