MHMDA

The My Health My Data Act protects consumer health data that falls outside HIPAA. Its definition of health data is very broad, it requires consent to collect and separate consent to share, it requires a signed authorization to sell, and it lets individuals sue. For many apps, websites and retailers, it is the strictest privacy law they face in the United States.

It applies from the first Washington consumer: there is no revenue or volume threshold.

• Regulated entities: any organization that conducts business in Washington, or targets products or services to Washington consumers, and alone or jointly decides how consumer health data is processed. Small businesses are covered too, on the same terms since 30 June 2024.
• Consumer health data is personal information that is linked or reasonably linkable to a consumer and identifies their past, present or future physical or mental health status. It includes conditions, treatments, medications, reproductive and sexual health, gender-affirming care, biometric and genetic data, precise location that could indicate an attempt to get health services, and information inferred from non-health data.
• Consumers include Washington residents and anyone whose data is collected in Washington. Data covered by HIPAA and some other federal laws is exempt.

Consumers can confirm and access their consumer health data, including a list of all third parties and affiliates that received it; delete it, with the deletion passed on to processors and third parties; and withdraw consent. Requests must be answered within 45 days, extendable once by 45 days, with an appeal process.

A violation is an unfair or deceptive act under Washington's Consumer Protection Act. The Attorney General enforces, and consumers can sue for damages, which has led to class actions over tracking technologies.

1. Map health data broadly, including inferences from purchases, searches, location and app use, and data sent by pixels and SDKs.
2. Publish a consumer health data privacy policy linked from your homepage.
3. Collect only with consent, and get separate consent before sharing.
4. Stop any sale unless you hold a valid signed authorization.
5. Remove geofences around in-person health care facilities.
6. Set up access and deletion requests that reach processors and third parties.
7. Review ad tech and analytics tags on pages that touch health topics.