The My Health My Data Act is Washington's health data privacy law requiring opt-in consent for all consumer health data with the broadest health data definition among US laws.

Can consumers sue under the MHMDA?

Yes. The MHMDA provides a private right of action: consumers can recover actual damages plus treble damages up to $25,000.

What is the MHMDA geofencing ban?

The MHMDA prohibits geofencing within 2,000 feet of healthcare facilities, preventing location-based targeting near medical facilities.

Does the MHMDA have size-based exemptions?

No. The MHMDA applies to businesses of any size that collect, share, or sell consumer health data of Washington residents.

MHMDA - Washington Health Data Privacy & Consent

Back to Regulations Guide

Key Facts

Effective Date

March 31, 2024

Enacted

April 27, 2023

Enforcing Authority

Washington Attorney General; Private right of action via Consumer Protection Act

Consent Model

Opt-in

Applies To

Any person conducting business in Washington or targeting Washington consumers that collects, shares, or sells consumer health data, with no size-based exemptions

Overview

Washington's My Health My Data Act is a sector-specific health data privacy law with the broadest health data definition among US laws. It requires opt-in consent for ALL consumer health data and uniquely prohibits geofencing within 2,000 feet of healthcare facilities. A private right of action enables individual lawsuits.

What This Means for Your Website

Opt-in consent is required for ALL consumer health data collection, sharing, and sale
Separate consent is needed for each category of health data
Geofencing is prohibited within 2,000 feet of healthcare facilities
No small business exemption: it applies to businesses of any size
A private right of action allows consumers to sue directly (treble damages up to $25,000)

Key Requirements

The Washington AG and private plaintiffs enforce the MHMDA. AG penalties reach $7,500 per violation. Private actions allow actual damages plus treble damages capped at $25,000. The broad health data definition covers far more than HIPAA. No revenue or data volume thresholds apply.

How ConsentStack Handles This

ConsentStack helps healthcare-adjacent websites obtain opt-in consent per health data category for Washington visitors, reducing exposure to both AG enforcement and private lawsuits.