Free whiteglove setup from a ConsentStack Concierge

MHMDA

Washington My Health My Data Act

Flag of US
Washington, United StatesOpt-inUS State LawsState
Back to Regulations Guide

Key Facts

Effective Date
March 31, 2024
Enacted
April 27, 2023
Enforcing Authority
Washington Attorney General; Private right of action via Consumer Protection Act
Consent Model
Opt-in
Applies To
Any person conducting business in Washington or targeting Washington consumers that collects, shares, or sells consumer health data, with no size-based exemptions

Overview

Washington's My Health My Data Act is a sector-specific health data privacy law with the broadest health data definition among US laws. It requires opt-in consent for ALL consumer health data and uniquely prohibits geofencing within 2,000 feet of healthcare facilities. A private right of action enables individual lawsuits.

What This Means for Your Website

  • Opt-in consent is required for ALL consumer health data collection, sharing, and sale
  • Separate consent is needed for each category of health data
  • Geofencing is prohibited within 2,000 feet of healthcare facilities
  • No small business exemption: it applies to businesses of any size
  • A private right of action allows consumers to sue directly (treble damages up to $25,000)

Key Requirements

The Washington AG and private plaintiffs enforce the MHMDA. AG penalties reach $7,500 per violation. Private actions allow actual damages plus treble damages capped at $25,000. The broad health data definition covers far more than HIPAA. No revenue or data volume thresholds apply.

How ConsentStack Handles This

ConsentStack helps healthcare-adjacent websites obtain opt-in consent per health data category for Washington visitors, reducing exposure to both AG enforcement and private lawsuits.

Penalties

$7,500 per violation (AG); Private action: actual damages + treble damages (cap $25,000).

Maximum Fine
$7,500 per violation

Key Requirements

  • Opt-in consent for ALL consumer health data collection, sharing, and sale
  • Geofencing prohibited within 2,000 feet of healthcare facilities
  • Separate consent for each category of health data
  • Consumer rights: access, delete, withdraw consent
  • No small business exemption for core requirements

Notable Provisions

  • Private right of action, unique among most US privacy laws
  • Geofencing prohibition around healthcare facilities (2,000 ft)
  • Broadest health data definition among US laws
  • No size-based exemptions

US State Specifics

Private Right of Action
Yes
Global Opt-out Required
No
Sensitive Data Opt-in
Yes

Other North America Regulations

CCPACalifornia, United States
The CCPA was the first comprehensive consumer privacy law in the United States, giving California residents the right to know what personal information businesses collect and to opt out of its sale. It established the opt-out consent model that most subsequent US state privacy laws adopted.
CPRACalifornia, United States
The CPRA is the most comprehensive US state privacy law with a dedicated enforcement agency (CPPA). Cross-context behavioral advertising via cookies constitutes sharing personal information, triggering opt-out obligations. GPC signals must be honored as valid opt-out requests.
PIPEDACanada
Canada's federal private-sector privacy law based on 10 fair information principles. Requires express consent for sensitive data and implied consent for less sensitive data. OPC guidance addresses cookies and online behavioral advertising. The CPPA replacement bill died January 2025; a new bill is expected.
CIPACalifornia, United States
CIPA is a 1967 California chapter covering wiretapping, eavesdropping, and other privacy invasions, not a website-specific law. Since 2022, courts have applied two of its sections to website chat, analytics, and ad tools, and any visitor can sue directly for at least $5,000 per violation, no revenue threshold.
MODPAMaryland, United States
The most restrictive US state privacy law. Sensitive data may only be processed when strictly necessary to deliver a requested service, and sale of sensitive data is completely prohibited even with consent. Under-18 sale and targeted advertising are prohibited regardless of consent. Strictest data minimization in the US.
TDPSATexas, United States
The TDPSA is the broadest US state privacy law: no revenue thresholds and no minimum consumer data volume thresholds. Applies to any non-small-business processing personal data of Texas residents. Must honor GPC signals since January 2025. This breadth means far more businesses are captured than under any other state law.

Frequently Asked Questions

Stay compliant with MHMDA

ConsentStack helps you implement Opt-in consent for Washington, United States automatically.

Get started free