How to use this checklist

Run it once for each product line, because a company can be a HIPAA business associate for one product and a regulated entity under Washington law for another. Work the phases in order the first time. On later reviews, start at Phase 3 and treat the earlier phases as a confirmation.

Each box is a task with its authority. A Note explains how it works in practice. A Red flag means stop and call counsel, because the next step may have legal consequences of its own, such as starting a notice clock or destroying evidence. Statute references are as of the "Last modified" date. Where state statutes are not linked, read the current text on the state legislature's site before relying on a section number.

The background is in Consumer Health Data Outside HIPAA: My Health My Data, the FTC, and the Apps That Know Too Much. The sequence and reasoning are in Bringing a Health App Into Compliance With Consumer Health Data Laws: A Practical Guide. The forms referred to below are in the Consumer Health Data Toolkit: Consent Forms, Data Maps, and Breach Notification Decisions.

Phase 0: Set up the review

  • Name an owner and a decision-maker. Authority: FTC orders in this area require a comprehensive privacy program, and 15 U.S.C. § 45 is the enforcement backstop. Note: The decision-maker must have authority over marketing spend. Reviews stall when legal can identify a tag but nobody can order it removed.
  • Decide whether counsel directs the review. Authority: attorney-client privilege and work product rules of the forum. Note: Engagement in writing, findings routed through counsel, and a clear purpose. The facts themselves won't be privileged, and the notice duties in Phase 12 don't go away because a lawyer ran the audit.
  • Check for a duty to preserve. Authority: common law duty and Fed. R. Civ. P. 37(e) once litigation is reasonably anticipated. Note: A demand letter, regulator contact, or credible user complaint can trigger it. Export tag manager histories, ad platform settings, SDK versions, and audience upload logs before changing anything.
  • List every product, site, app, and business unit in scope. Include marketing sites, landing pages, onboarding quizzes, and acquired brands. Note: The landing page and the quiz are where the most revealing URLs and answers tend to be.

Red flag: A tag has been found sending health data and someone proposes to delete it today, quietly. Preserve first, then remove. Both can happen the same day.

Phase 1: Draw the HIPAA boundary

Red flag: You have no BAA with a vendor that receives data from a HIPAA-covered customer's patients. That may be a HIPAA problem now, and your customer may have contractual notice rights.

Phase 2: Map the applicable law

  • FTC Act. Authority: 15 U.S.C. § 45, with § 45(n) for unfairness. Note: Assume it applies. List your privacy promises for Phase 6.
  • Health Breach Notification Rule. Authority: 16 C.F.R. § 318.2, 42 U.S.C. § 17937. Note: Test "technical capacity to draw information from multiple sources." Device sync, HealthKit or Health Connect import, and an API that adds data all count toward yes. The FTC's September 9, 2026 rescission of its 2021 policy statement did not change the rule.
  • Washington My Health My Data Act. Authority: RCW 19.373.010 (regulated entity, small business, consumer, consumer health data). Note: No revenue or volume threshold. The attorney general's FAQ says an entity that only stores data in Washington is not regulated, and treats non-prescription purchases as covered only if the business draws an inference. Both are guidance, not holdings.
  • Nevada S.B. 370. Authority: Nev. S.B. 370 (2023), NRS ch. 603A. Note: Entity-level exemption for those subject to HIPAA and GLBA. Definition turns on data the entity uses to identify health status. No private claim.
  • Connecticut consumer health data and CTDPA. Authority: Conn. Gen. Stat. §§ 42-515, 42-526; 2025 S.B. 1295. Note: Section 42-526 has no volume threshold. Since July 1, 2026, the CTDPA reaches anyone processing sensitive data of Connecticut consumers, with some exemptions. Recheck if you concluded you were under the old threshold.
  • Maryland Online Data Privacy Act. Authority: Md. S.B. 541/H.B. 567 (2024). Note: Limits on sensitive data collection and a bar on sale. Read the current text.
  • Virginia reproductive health data. Authority: Va. Code § 59.1-200(A)(85), § 59.1-204. Note: Private action for those who suffer loss: actual damages or $500; willful, up to treble or $1,000. GLBA-covered information excluded.
  • Other omnibus state laws' sensitive data provisions. Authority: state statutes; see State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork. Note: Note where the law says "diagnosis" and where it says "condition." Also check 2026 changes, including geolocation and sensitive data sale bans.
  • California CMIA. Authority: Cal. Civ. Code §§ 56.05, 56.06, 56.10, 56.101, 56.36; J.M. v. Illuminate Education, Inc., No. S286699 (Cal. May 14, 2026). Note: The question is whether the software is designed to maintain medical information so a person can manage it, or for diagnosis, treatment, or management of a condition. J.M. shows storage alone is not enough.
  • Illinois GIPA. Authority: 410 ILCS 513/15, 513/30, 513/40; Bridges v. Blackstone, Inc., 66 F.4th 687 (7th Cir. 2023). Note: Applies if you touch genetic tests or results, including indirectly through a pixel on a results page.
  • Wiretap statutes. Authority: 18 U.S.C. §§ 2510, 2511, 2520; Cal. Penal Code §§ 631, 632, 637.2. Note: California requires all-party consent, with $5,000 per violation. Treat CIPA as a design constraint for any site with California users.
  • Substance use disorder records. Authority: 42 U.S.C. § 290dd-2, 42 C.F.R. Part 2. Note: Addiction products should determine early whether they are a federally assisted program. The FTC used a separate opioid recovery statute against Monument.
  • Children and teens. Authority: 15 U.S.C. § 6501; COPPA checklist. Note: Period, mental health, and fitness apps often have minors among users.

Phase 3: Capture what actually happens

  • Run a proxied traffic capture for each mobile flow, on iOS and Android, with tracking permission granted and denied. Authority: the facts decide the analysis under all of the above; see FTC's Premom and Flo matters on SDK data. Note: Use a test account with an obvious fake condition, so it is easy to spot in payloads.
  • Capture web traffic logged in and logged out, including quiz flows and forms. Authority: Doe v. Adventist Health System/West, No. B344951 (Cal. Ct. App. July 24, 2026), for why URLs matter. Note: Read the query strings. A results URL can contain the answer or a link to it.
  • Inventory server-side flows. Authority: FTC complaint, FTC v. Hims & Hers, No. 3:26-cv-7871 (N.D. Cal.) (Meta Pixel and Conversions API). Note: Conversions API, server-side tag managers, customer data platforms, warehouse exports, and reverse ETL. A browser capture will never show these.
  • Inventory customer list uploads and lookalike seeds in each ad account. Authority: FTC's GoodRx and Hims & Hers matters; Rand v. Eyemart Express, L.L.C., No. 25-10784 (5th Cir. Oct. 23, 2026) (allegations about customer lists). Note: Ask a person who runs the account. Check dates and audience names.
  • Reconcile against accounts payable, SSO, and app dependency files. Authority: RCW 19.373.040(1)(a) (duty to list all recipients).
  • Build the data map. Authority: RCW 19.373.020, .030, .040, .060. Use the toolkit's template. Note: Each line needs data element, recipient, role, basis, contract, retention, and deletion path.
  • Classify each element against each state's definition. Authority: RCW 19.373.010(8); Conn. Gen. Stat. § 42-515; S.B. 370. Note: Include inferred data, and flag any audience segments named after a condition.
  • Review event names one by one. Authority: FTC's Monument and Flo matters. Note: If an event name would embarrass a user on a billboard, it should not go to a third party.

Red flag: The capture shows a health-revealing event going to a recipient with no consent or contract in place. Go to Phase 12 now, and keep going with the rest of the review in parallel.

Phase 4: Decide on ad-tech

  • Remove or block advertising SDKs and pixels on every surface that touches consumer health data, unless valid consent exists. Authority: RCW 19.373.030; FTC orders against GoodRx, BetterHelp, Premom, Cerebral, and Monument, each of which bans sharing health data for advertising. Note: Remember that an order's terms bind only that party, but they show what the agency thinks a remedy looks like.
  • Stop customer list uploads containing health-related segments. Authority: same; Rand on "paired" identity. Note: Hashing doesn't change this. Hashes exist so that the platform can match them.
  • Turn off automatic event collection and "forward all events." Authority: 16 C.F.R. § 318.2 (unauthorized disclosure). Note: Many SDKs forward events by default. Check the settings and the traffic.
  • Restrict analytics vendors to processor terms or remove them. Authority: RCW 19.373.060.
  • Scrub URLs, titles, and referrers. Authority: In re Zynga Privacy Litigation, 750 F.3d 1098 (9th Cir. 2014) on search terms in URLs; Shah v. MyFitnessPal, Inc., No. 25-cv-04430 (N.D. Cal. Sept. 28, 2026). Note: Slugs like /conditions/depression/ can reveal the health topic.
  • Remove session replay from forms and health pages. Authority: In re BPS Direct, LLC, 175 F.4th 423 (3d Cir. 2026). Note: It records what users type, and that can include card numbers and intake answers.
  • Document the revenue test. Authority: none. A/B results tell the decision-maker what the removal cost.

Red flag: Someone suggests renaming events to neutral codes while keeping the flow. That reduces nothing and may look like concealment.

See Website Tracking Compliance Checklist: A Practical Checklist for general tag review.

Phase 5: Consent

  • Classify every collection and sharing activity as necessary or consent-based. Authority: RCW 19.373.030(1)(a)-(b). Note: "Necessary to provide a product or service" the consumer requested is undefined. Advertising, sale, and unrelated analytics don't qualify.
  • Get consent before collection or sharing. Authority: RCW 19.373.030(1)(c); Kady. Note: Test the order in which code initializes. A consent screen that follows an SDK start is not prior consent.
  • Use separate consents for collection and sharing. Authority: RCW 19.373.030(1)(b); S.B. 370.
  • Include required disclosures in each request. Authority: RCW 19.373.030(1)(c)(i)-(iv). Note: Categories, purpose and specific uses, categories of recipients, and how to withdraw.
  • Eliminate invalid consent paths. Authority: RCW 19.373.010(6)(b); FTC orders on dark patterns. Note: No consent via general terms, hover or close, or deceptive design. See Dark Patterns, Auto-Renewal, and the FTC Click-to-Cancel Rule.
  • Verify that consent state controls code in production. Authority: Shah v. MyFitnessPal. Note: Test by opting out and running the capture again. A banner that doesn't work may support concealment tolling.
  • Keep a consent ledger. Authority: burden on the party asserting consent, as in In re Meta Pixel Healthcare Litigation, No. 22-cv-03580 (N.D. Cal. Sept. 7, 2023). Note: User, text version, time, and choice.
  • Implement withdrawal. Authority: RCW 19.373.040(1)(b).
  • Obtain new consent before new categories or purposes. Authority: RCW 19.373.020(1)(c)-(d).
  • Check non-discrimination. Authority: RCW 19.373.030(1)(d).

Phase 6: Public statements and policy

  • Publish a consumer health data privacy policy with a separate link. Authority: RCW 19.373.020; Washington AG FAQ. Note: The AG says the link must be "separate and distinct" and the policy may not contain additional information not required by the Act. Include app store and in-app locations.
  • Confirm required contents. Authority: RCW 19.373.020(1)(a). Note: Categories collected and purpose, sources, categories shared, categories of third parties, specific affiliates, and how to exercise rights.
  • Do an engineer's line-by-line truth check. Authority: 15 U.S.C. § 45(a). Note: Compare each sentence with the data map. In re BetterHelp, Inc. Data Disclosure Cases, No. 23-cv-01033 (N.D. Cal. July 15, 2024), shows how FTC allegations turn into class claims.
  • Audit ad copy, FAQs, app store text, sales decks, and support macros. Authority: FTC's Hims & Hers complaint, Count I ("private," "discreet," "only accessed by" providers).
  • Check that "anonymous" and "de-identified" are accurate. Authority: RCW 19.373.010(10); Frasco v. Flo Health, Inc., No. 21-cv-00757 (N.D. Cal. May 22, 2025). Note: Washington requires reasonable measures, a public commitment, and contractual flow-down.
  • Update general privacy policy and cross-reference. See Privacy Policy Drafting and Review Checklist: A Practical Checklist.

Red flag: A public denial is being drafted in response to a press inquiry. The FTC alleged BetterHelp falsely denied news reports about sharing data. Verify facts before answering.

Phase 7: Vendors

Phase 8: Sale

  • List every exchange of consumer health data for money or other value. Authority: RCW 19.373.010(26). Note: Include free services in return for data rights, data co-ops, and lead-generation fees.
  • Decide whether to stop or to build a valid authorization. Authority: RCW 19.373.070; S.B. 370; Conn. Gen. Stat. § 42-526; Maryland's act. Note: A nationwide sales program is close to unworkable, given Maryland's bar.
  • If authorization is used, confirm all elements. Authority: RCW 19.373.070(2). Note: Specific data, seller, purchaser, purpose, no-conditioning statement, revocation, redisclosure warning, one-year expiration, signature and date.
  • Check for defects. Authority: RCW 19.373.070(3). Note: Expired, incomplete, revoked, compound, or conditioned authorizations are invalid.
  • Provide a copy and retain for six years, on both sides. Authority: RCW 19.373.070(4)-(5).
  • Add M&A and financing protections. Authority: RCW 19.373.010(26)(b)(i), 11 U.S.C. § 363(b), Bridges. Note: The sale exclusion for a deal depends on the acquirer complying with the chapter. Put that into the agreement.

Phase 9: Consumer rights

  • Offer a secure request channel that matches how consumers interact with you. Authority: RCW 19.373.040(1)(d). Note: No new account can be required.
  • Be able to confirm and give access, with a list of all third parties and affiliates and a contact for each. Authority: RCW 19.373.040(1)(a).
  • Delete from all systems, including backups within six months. Authority: RCW 19.373.040(1)(c). Note: Decide among short backup retention, crypto-shredding, or a suppression list on restore.
  • Notify all recipients of deletion. Authority: RCW 19.373.040(1)(c)(i)(B).
  • Meet the deadlines. Authority: RCW 19.373.040(1)(g). Note: 45 days from receipt, one extension of 45 with notice and reason. Authentication doesn't stop the clock.
  • Build the appeal path. Authority: RCW 19.373.040(1)(h). Note: Conspicuous, 45 days for a written decision, and AG contact on denial.
  • Track fees and repeat requests. Authority: RCW 19.373.040(1)(f). Note: Free twice a year. The company bears the burden to show a request is excessive.
  • Train support. See Data Subject Rights Request Handling Checklist: A Practical Checklist.

Phase 10: Security and retention

  • Limit access to those who need it. Authority: RCW 19.373.050(1)(a); Conn. Gen. Stat. § 42-526 (confidentiality duty for employees and contractors).
  • Meet a reasonable industry standard of care. Authority: RCW 19.373.050(1)(b); FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015). Note: Offboarding, MFA, encryption, logging, and access tests. FTC's Cerebral complaint is a useful list of ordinary failures.
  • Assess CMIA exposure for negligent maintenance. Authority: Cal. Civ. Code § 56.101, § 56.36(b), J.M.. Note: Plaintiffs need not allege actual viewing. Significant risk of unauthorized access or use is the test, and the 2013 and 2014 Court of Appeal cases to the contrary were disapproved to that extent.
  • Adopt and publish a retention schedule. Authority: FTC orders; see Data Minimization and Avoiding the Over-Retention of Personal Information.
  • Encrypt where the architecture permits it. Authority: HHS guidance referred to in 16 C.F.R. § 318.2 ("unsecured"). Note: Encrypted data under that guidance is not "unsecured," which can remove a stolen-data event from the rule.

Phase 11: Location and geofencing

  • List every location data flow and its precision. Authority: RCW 19.373.010(19) (1,750-foot radius).
  • Audit campaigns, audiences, and triggers for geofences near care facilities. Authority: RCW 19.373.080 (2,000 feet); S.B. 370 (1,750 feet); Conn. Gen. Stat. § 42-526 (1,750 feet); Maryland's act. Note: Washington's "health care services" definition is broad. Pharmacies, clinics, and arguably wellness services are in the zone.
  • Give written instructions to agencies and vendors. Authority: RCW 19.373.080 ("any person").
  • Drop precise location unless it is core to the product, and shorten its retention. Authority: RCW 19.373.030; FTC v. Kochava, Inc., No. 2:22-cv-00377 (D. Idaho Feb. 3, 2024).
  • Do diligence on location data suppliers. Authority: FTC's May 2026 Kochava stipulated order (sensitive location and supplier assessment programs).
  • Check state bans on sale of precise geolocation. Authority: state laws amended in 2025 and 2026, including Virginia and Connecticut.

Red flag: A background location SDK is running in an app with no location feature. This is the theory in In re Amazon Ads SDK Litigation, No. 2:25-cv-00252 (W.D. Wash.).

Phase 12: Breach and disclosure decisions

Red flag: The team wants to wait for the investigation to finish before starting the count. The clock runs from when you reasonably should have known. Write down your reasoning either way.

Phase 13: Reproductive data and legal process

  • Identify reproductive, sexual health, and gender-affirming data. Authority: RCW 19.373.010(8)(b)(vii)-(viii), (11), (24); Cal. Civ. Code § 56.05; Va. Code § 59.1-200(A)(85).
  • Confirm your HIPAA documents reflect the vacatur. Authority: Purl v. U.S. Department of Health & Human Services, No. 2:24-cv-228 (N.D. Tex. June 18, 2025); 45 C.F.R. § 164.520. Note: The Notice of Privacy Practices changes tied to Part 2 survived. Attestation requirements did not.
  • Adopt a legal process policy. Authority: RCW 19.373.100(3), which has no general subpoena exception; Government Data Demand Toolkit: Legal Process Review, Objections, and Notification.
  • Align public statements with the process. Authority: 15 U.S.C. § 45(a).
  • Reduce what exists. Authority: Dobbs v. Jackson Women's Health Organization, 597 U.S. 215 (2022), as the context for why it matters. Note: Consider on-device storage, end-to-end encryption, and short retention for the most sensitive data.

Phase 14: Special categories

Phase 15: Litigation readiness

Phase 16: Keep it working

  • Put a privacy gate on tag publishing and SDK additions. Authority: FTC orders requiring privacy programs.
  • Repeat the traffic capture quarterly. Authority: RCW 19.373.020 (policy must stay accurate).
  • Reconfirm PHR status at each integration. Authority: 16 C.F.R. § 318.2.
  • Train marketing and growth staff annually. Authority: FTC's BetterHelp allegations.
  • Review state law changes twice a year. Authority: New York's vetoed S.929 and its reissued successor bill, plus 2026 amendments in Connecticut, Maryland, New Jersey, and Virginia.
  • Report results to leadership and keep the record. See Privacy Compliance Program Checklist: A Practical Checklist.

This checklist is general information and is not legal advice for a specific situation.

Related Documents

Related Articles

Related Guides

Related Checklists

Related Toolkits