Health data has become one of the most sensitive categories of PI, expanding far beyond HIPAA‑regulated healthcare settings to include consumer apps, digital advertising and analytics. As states enact a growing patchwork of privacy and health‑specific laws with inconsistent definitions, organizations face increasing uncertainty and enforcement risk when classifying non‑HIPAA data. In response, the Network Advertising Initiative (NAI) recently released its Factor Analysis for Health‑Related Sensitive Personal Information, a five‑factor, context‑driven framework to support more disciplined, risk‑based decisions. In this guest article, Kelley Drye partner Aaron Burstein and associate Meaghan Donahue examine the complex regulatory forces and how companies can use contextual frameworks like the NAI’s to navigate the health data landscape more effectively. See “Addressing the Operational Complexities of Complying With the Washington My Health My Data Act” (Apr. 3, 2024).