Washington My Health My Data Act: A Compliance Checklist for HealthTech, Wellness and SaaS Teams

Short answer: The Washington My Health My Data Act (RCW 19.373) protects health data that HIPAA usually does not cover. If you collect consumer health data from Washington consumers, you need a dedicated consumer health data privacy policy, opt-in consent to collect, separate consent to share, a signed authorization to sell, and a 45-day consumer rights process.

Related guides:

• US data privacy compliance checklist: CCPA/CPRA, CPA, CTDPA, UCPA and VCDPA
• Who does HIPAA apply to? A decision guide for HealthTech and SaaS founders
• CCPA compliance

Key takeaways

• It targets health data outside HIPAA, such as data from wellness apps, wearables and online pharmacies, including health status you infer from non-health data.
• There is no revenue threshold. The 100,000-consumer test only decides whether you are a "small business."
• Consent is layered. Collecting needs consent, sharing needs separate consent, and selling needs a signed authorization that expires after one year.
• Consumers can sue. Violations are enforced under the Consumer Protection Act by the Attorney General and through private action.
• PHI under HIPAA is exempt, but a HealthTech company can still hold consumer data that is not PHI.

What is the Washington My Health My Data Act?

The Washington My Health My Data Act is chapter 19.373 RCW, a 2023 law that limits how companies collect, share and sell consumer health data about people in Washington. The Washington Attorney General describes it as the first privacy-focused law in the country to protect personal health data falling outside HIPAA.

The Act was signed on April 27, 2023 and took effect section by section. As of October 2026, every date below has passed.

Requirement	Who	Compliance date
Geofencing ban (section 10, RCW 19.373.080)	All persons	July 23, 2023
Sections 4 to 9 (policy, consent, rights, security, processors, sale)	Regulated entities	March 31, 2024
Sections 4 to 9	Small businesses	June 30, 2024

Source for all three dates: the Washington Attorney General's MHMDA guidance.

What counts as consumer health data?

Consumer health data is personal information that is linked or reasonably linkable to a consumer and identifies their past, present or future physical or mental health status, as defined in RCW 19.373.010(8). The statute lists categories that include:

• health conditions, treatment, diagnoses, procedures and use or purchase of prescribed medication
• bodily functions, vital signs, symptoms or measurements
• gender-affirming care and reproductive or sexual health information
• biometric data and genetic data
• precise location information that could reasonably indicate an attempt to receive health services or supplies
• data that identifies a consumer seeking health care services
• any of the above derived or inferred from non-health data, for example through algorithms or machine learning

The Attorney General gives concrete examples: an app that tracks digestion or perspiration is collecting consumer health data, and so is a retailer that infers health status from purchases. Buying toiletries alone generally is not.

For SaaS teams, the inference category matters most: ad segments or models that infer conditions such as pregnancy can turn ordinary data into consumer health data. Note that "consumer" covers only people acting in an individual or household context, and excludes people acting in an employment context.

Who must comply with MHMDA?

You are a regulated entity if you conduct business in Washington, or target products or services to Washington consumers, and you alone or jointly determine how consumer health data is processed (RCW 19.373.010). Government agencies, tribal nations and their contracted service providers are excluded.

The law defines three roles:

1. Regulated entity. Any legal entity meeting the test above. There is no revenue threshold. The Attorney General confirms that out-of-state businesses are covered when they do business in or target Washington, and that an entity that only stores data in Washington is not a regulated entity.
2. Small business. A regulated entity that collects, processes, sells or shares consumer health data of fewer than 100,000 consumers in a calendar year, or that derives less than half its gross revenue from consumer health data and handles data of fewer than 25,000 consumers (RCW 19.373.010(28)). Small businesses had the later June 30, 2024 date but the same obligations.
3. Processor. A person that processes consumer health data on behalf of a regulated entity or small business. Out-of-state processors must comply too.

MHMDA sits on top of comprehensive state privacy laws, which our US data privacy compliance checklist covers.

What consent does MHMDA require to collect, share or sell?

MHMDA requires three separate permissions: consent to collect, a separate consent to share, and a signed valid authorization to sell, unless collection or sharing is necessary to provide a product or service the consumer requested (RCW 19.373.030).

Activity	What you need	Key rules
Collect	Consent for a specified purpose, or necessity for a requested service	Obtained before collection
Share	Consent separate and distinct from collection consent, or necessity	Obtained before sharing
Sell	Valid authorization signed by the consumer	Expires one year after signing; keep copies six years

Consent must be a clear affirmative act that is freely given, specific, informed, opt-in and unambiguous. It cannot come from accepting general terms of use, from hovering over or closing content, or from deceptive design. Each request must disclose the categories of data, the purpose, the categories of recipients and how to withdraw consent.

Selling is defined broadly as exchanging consumer health data for money or other valuable consideration. Under RCW 19.373.070, the valid authorization must be in plain language and separate from other consents. It must name the data, buyer, seller and purpose, state that goods or services cannot be conditioned on signing, explain revocation, and expire one year from signing. Seller and buyer each keep a copy for six years from signature or last effective date, whichever is later.

In our experience, the sale rule is most likely to catch marketing stacks, so review pixels and data partnerships with counsel.

What must your privacy policy, rights process and security cover?

You need a standalone consumer health data privacy policy, a 45-day rights process with appeals, and access limits plus reasonable safeguards.

Consumer health data privacy policy. RCW 19.373.020 requires a policy that clearly and conspicuously discloses the categories of data collected and why, the sources, the categories shared, the categories of third parties and the specific affiliates that receive it, and how consumers can exercise their rights. You must prominently link it from your homepage. Using data for a new category or purpose requires disclosure and fresh consent first.

Consumer rights. Under RCW 19.373.040, consumers can:

• confirm whether you collect, share or sell their consumer health data, and access it
• get a list of all third parties and affiliates you shared or sold it to
• withdraw consent
• have their data deleted from all records, including archives and backups, with deletion notices passed to affiliates, processors, contractors and third parties

Respond within 45 days, extendable once by 45 days if you explain why within the first period. Backup deletion can wait for restoration, but no more than six months after authentication. Answer appeals in writing within 45 days and, on denial, give a way to contact the Attorney General.

Security and access. RCW 19.373.050 limits access to employees, processors and contractors who need it for the consented purpose, and requires administrative, technical and physical safeguards that meet a reasonable standard of care in your industry.

Processors. A processor may only handle consumer health data under a binding contract that sets processing instructions, and must help you meet your obligations. A processor that goes beyond those instructions is treated as a regulated entity for that data.

What is the geofencing ban, and how is MHMDA enforced?

It is unlawful for any person to place a geofence within 2,000 feet of a facility that provides in-person health care services to identify or track consumers seeking care, collect consumer health data, or send them notifications, messages or ads (RCW 19.373.080 and the geofence definition). This applies to everyone, not only regulated entities, and has applied since July 23, 2023.

Enforcement runs through Washington's Consumer Protection Act. RCW 19.373.090 makes a violation an unfair or deceptive act under chapter 19.86 RCW, and the Attorney General confirms the law is enforced by its office as well as through private action. Separately, health apps should also check whether the FTC Health Breach Notification Rule applies to breaches of the same data.

Which data is exempt, including PHI under HIPAA?

MHMDA exempts data already governed by specific health and financial laws, but the exemption follows the data, not the company (RCW 19.373.100).

Exempt information includes:

• protected health information under HIPAA, and data de-identified under HIPAA from exempt information
• health care information under chapter 70.02 RCW and patient identifying information under 42 CFR Part 2
• identifiable information from human subjects research, and certain quality improvement and patient safety records
• information used for public health activities or as a limited data set under HIPAA
• personal information governed by laws such as GLBA, FCRA and FERPA
• collection or use needed to prevent or respond to security incidents, fraud, harassment or illegal activity, where you carry the burden of proving the exemption applies

A business associate can hold both PHI and non-PHI: data your app collects directly from consumers outside a covered entity relationship is often not PHI. If unsure, start with who HIPAA applies to and what is considered PHI, then map each data flow.

A 30-60-90 day My Health My Data Act compliance checklist

Because every compliance date has passed, treat this as a remediation plan: inventory first, fix consent and sale risks next, then operationalize rights and evidence.

Days 1 to 30: scope and inventory

• Confirm whether you do business in or target Washington consumers.
• Map every data flow that could be consumer health data, including inferred data, location and biometrics.
• Tag flows that are exempt (PHI, Part 2, GLBA) and document why.
• Classify your role per product: regulated entity, small business or processor.
• List every third party, affiliate, SDK and pixel that receives health-related data, and flag anything that could be a sale.
• Check location features and ad targeting for geofences near health care facilities.

Days 31 to 60: consent, policy and contracts

• Build separate consent flows for collection and for sharing, outside your terms of use.
• Stop any sale until you have a compliant valid authorization, with one-year expiry and six-year retention.
• Publish a consumer health data privacy policy and link it from your homepage.
• Put binding processing contracts in place with every processor.
• Restrict access to people who need it.

Days 61 to 90: rights, monitoring and evidence

• Launch access, deletion and consent withdrawal workflows with a 45-day clock and an appeal path.
• Extend deletion to backups and downstream recipients.
• Add MHMDA checks to change management for new features, models and vendors.
• Keep evidence: consent logs, authorizations, contracts, request tickets and policy versions.

How SecureSlate helps

SecureSlate does not have a built-in My Health My Data Act page, so teams set MHMDA up as a custom framework with custom controls for consent, sale authorization, the consumer health data privacy policy and the 45-day rights process. Multi-framework control mapping lets those controls sit alongside built-in HIPAA, SOC 2, ISO 27001 and GDPR, so shared controls such as access restriction are tested once. Access reviews provide evidence that only authorized staff reach consumer health data, vendor risk management tracks processors and data recipients, and risk management records decisions such as how a data partnership is classified. Agentless read-only cloud integrations collect technical evidence, audit management organizes it, and the trust center and security questionnaire automation help answer buyer questions.

Start your free SecureSlate trial

FAQ

Does the My Health My Data Act apply to companies outside Washington?

Yes, if they conduct business in Washington or target products or services to Washington consumers and determine how consumer health data is processed. Out-of-state processors must comply too, but a company that only stores data in Washington is not a regulated entity, according to the Attorney General.

Is there a minimum size or revenue threshold for MHMDA?

No. Any regulated entity is covered. The 100,000-consumer and 25,000-consumer tests only decide whether you count as a small business, which had a later compliance date of June 30, 2024.

Can consumers sue under the Washington My Health My Data Act?

Yes. Violations are Consumer Protection Act violations, and the Attorney General states the law is enforced through private action as well as by its office.

Does MHMDA apply if we are HIPAA compliant?

Only to data that is not exempt. PHI under HIPAA is exempt, but consumer data you collect outside a covered entity or business associate relationship can still be consumer health data under MHMDA.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.